ＨｉｄｅＺｅｒｏＯｎｅ

SEC503: Network Monitoring and Threat Detection In-Depth delivers the technical knowledge, insight, and hands-on training you need to confidently defend your network, whether traditional or cloud-based. You will learn about the underlying theory of TCP/IP and the most used application protocols so that you can intelligently examine network traffic to identify emerging threats, perform large-scale correlation for threat hunting, and reconstruct network attacks. 37 Hands-on Labs + Capstone Challenge

SEC450 provides students with technical knowledge and key concepts essential for security operation center (SOC) analysts and new cyber defense team members. By providing a detailed explanation of the mission and mindset of a modern cyber defense operation, this course will jumpstart and empower those on their way to becoming the next generation of blue team members.

SEC450.1: Security Operations Teams, Tools, And Mission Overview
SEC450.2: Network Traffic Analysis
SEC450.3: Endpoint Defense, Security Logging, and Malware Identification Overview
SEC450.4: Efficient Alert Triage and Email Analysis
SEC450.5: Continuous Improvement, Analytics, and Automation
SEC450.6: Capstone: Defend the Flag

SEC450: Blue Team Fundamentals: Security Operations and Analysis

Cyber threat intelligence represents a force multiplier for organizations looking to update their response and detection programs to deal with increasingly sophisticated advanced persistent threats. Malware is an adversary’s tool but the real threat is the human one, and cyber threat intelligence focuses on countering those flexible and persistent human threats with empowered and trained human defenders. During a targeted attack, an organization needs a top-notch and cutting-edge threat hunting or incident response team armed with the threat intelligence necessary to understand how adversaries operate and to counter the threat. FOR578: Cyber Threat Intelligence will train you and your team in the tactical, operational, and strategic level cyber threat intelligence skills and tradecraft required to make security teams better, threat hunting more accurate, incident response more effective, and organizations more aware of the evolving threat landscape.

FOR578: Cyber Threat Intelligence

CyberChef for Security Analysts will teach you how to use CyberChef to perform common data manipulation, transformation, deobfuscation, and extraction techniques using real security data*. This isn’t just a simple tutorial, you’ll work through diverse exercises using real-world security data to build a toolkit of techniques.Simply put, CyberChef for Security Analysts is an example-driven master class on dealing with the most common types of data you’ll encounter in common blue team roles like SOC analysts, malware reverse engineering, forensic investigations, threat hunting, and threat intelligence.

Syllabus

• CyberChef Basics
• Character Encoding and Encryption
• Data Formatting, Parsing, and other Manipulation
• Defeating Malware Obfuscation
• Log File and Forensic Analysis Techniques
• Image Manipulation
• HTTP Requests and JSON Data

CyberChef for Security Analysts

Whether you handle an intrusion incident, data theft case, employee misuse scenario, or are engaged in proactive adversary discovery, the network often provides an unparalleled view of the incident. SANS FOR572 covers the tools, technology, and processes required to integrate network evidence sources into your investigations to provide better findings, and to get the job done faster.

FOR572.1: Off the Disk and Onto the Wire
FOR572.2: Core Protocols & Log Aggregation/Analysis
FOR572.3: NetFlow and File Access Protocols
FOR572.4: Commercial Tools, Wireless, and Full-Packet Hunting
FOR572.5: Encryption, Protocol Reversing, OPSEC, and Intel
FOR572.6: Network Forensics Capstone Challenge

FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

The rapid adoption of cloud services has created exciting new business capabilities and new cyber-attack opportunities. To detect these threats, companies require skilled security analysts who understand attack techniques, perform cloud security monitoring and investigations, and detection capabilities across the organization. The SEC541 course focuses on Cloud Threat Detection, covering various attack techniques used against cloud infrastructure and teaching the observation, detection, and analysis of cloud telemetry. With 20 hands-on labs and CTF, this course equips security analysts, detection engineers, and threat hunters with practical skills and knowledge to safeguard their organization’s cloud infrastructure against potential threats. Upon completion, you can apply these newfound skills to help keep your organization’s cloud infrastructure secure.

SEC541.1: Management Plane and Networking Logging
SEC541.2: Computer and Cloud Services Logging
SEC541.3: Cloud Services and Data Discovery
SEC541.4: Microsoft Ecosystem
SEC541.5: Automate Response Actions and CloudWars

SEC541: Cloud Security Attacker Techniques, Monitoring, and Threat Detection