CSA-Certified SOC Analyst
-
COURSE DATES AND LOCATIONS
DATE
Duration
LOCATION
FEES
Book Now
-
INTRODUCTION
The Certified SOC Analyst (CSA) program is the initial step to join a security operations center (SOC). It is engineered for current and aspiring Tier I and Tier II SOC analysts to achieve proficiency in performing entry-level and intermediate-level operations.
The SOC Analyst course also introduces the practical aspect of SIEM using advanced and the most frequently used tools. The candidate will learn to perform enhanced threat detection using the predictive capabilities of Threat Intelligence.
-
COURSE OBJECTIVES
By the end of the course, you‘ll be able to:
- Gain Knowledge of SOC processes, procedures, technologies, and workflows.
- Learn a basic understanding and in-depth knowledge of security threats, attacks, vulnerabilities, attacker’s behaviors, cyber killchain.
- Recognize attacker tools, tactics, and procedures to identify indicators of compromise (IOCs) that can be utilized during active and future investigations.
- Able to monitor and analyze logs and alerts from a variety of different technologies across multiple platforms (IDS/IPS, end-point protection, servers, and workstations).
- Gain knowledge of the Centralized Log Management (CLM) process.
- Able to perform Security events and log collection, monitoring, and analysis.
- Gain experience and extensive knowledge of Security Information and Event Management.
- Gain knowledge of administering SIEM solutions (Splunk/AlienVault/OSSIM/ELK).
- Understand the architecture, implementation and fine-tuning of SIEM solutions
-
COURSE AUDIENCE
This course is made for
- SOC Analysts
- Network and Security Administrators
- Network and Security Engineers, Network Defense Analyst and Network Defense Technicians
- Network Security Specialist and Network Security Operator
- Cybersecurity Analyst
- Cybersecurity professionals
-
COURSE OUTLINE
Day One
Security Operations and Management
- Understand the SOC Fundamentals
- Discuss the Components of SOC: People, Processes and Technology
- Understand the Implementation of SOC
Day Two
Understanding Cyber Threats, IoCs, and Attack Methodology
- Describe the term Cyber Threats and Attacks
- Understand the Network Level Attacks
- Understand the Host Level Attacks
- Understand the Application Level Attacks
- Understand the Indicators of Compromise (IoCs)
- Discuss the Attacker’s Hacking Methodology
Day Three
Incidents, Events, and Logging
- Understand the Fundamentals of Incidents, Events, and Logging
- Explain the Concepts of Local Logging
- Explain the Concepts of Centralized Logging
Day Four
Incident Detection with Security Information and Event Management (SIEM)
- Understand the Basic Concepts of Security Information and Event Management (SIEM)
- Discuss the Different SIEM Solutions
- Understand the SIEM Deployment
- Learn Different Use Case Examples for Application Level Incident Detection
- Learn Different Use Case Examples for Insider Incident Detection
- Learn Different Use Case Examples for Network Level Incident Detection
- Learn Different Use Case Examples for Host Level Incident Detection
- Learn Different Use Case Examples for Compliance
- Understand the Concept of Handling Alert Triaging and Analysis
Day Five
Enhanced Incident Detection with Threat Intelligence
- Learn Fundamental Concepts on Threat Intelligence
- Learn Different Types of Threat Intelligence
- Understand How Threat Intelligence Strategy is Developed
- Learn Different Threat Intelligence Sources from which Intelligence can be Obtained
- Learn Different Threat Intelligence Platform (TIP)
- Understand the Need of Threat Intelligence-driven SOC
Incident Response
- Understand the Fundamental Concepts of Incident Response
- Learn Various Phases in Incident Response Process
- Learn How to Respond to Network Security Incidents
- Learn How to Respond to Application Security Incidents
- Learn How to Respond to Email Security Incidents
- Learn How to Respond to Insider Incidents
- Learn How to Respond to Malware Incidents
