- Learning Path Libraries: This path is only available in the libraries listed. To access this path, purchase a license for the corresponding library.
- Security
Security Event Triage
## This path covers the knowledge and skills required to operate as a Security Analyst.
Additionally, the skills covered directly align to the following CSWF and Industry Roles:
**NICE Cyber Security Workforce Framework Roles:** - Cyber Defense Analyst (PR-CDA-001)
**Industry Job Roles:** - SOC (Security Operations Center) Analyst Level 1 - 3 - Information Security Analyst - Cyber Security Analyst
Attack & subsequent detection scenarios cover both basic and advanced threat actor profiles aligned with common MITRE ATT&CK techniques and follow the entire chain of attack.
Content in this path
SOC Analyst Level 1
In this section, you will be introduced to the concepts associated with security event triage. Then, you will cover how these concepts fit into the security operations life cycle of an organization, and what tools and methods are used to implement these capabilities. Finally, you will learn the common skills used for network and endpoint analysis to detect known attacks. All skills learned in this path map to the NIST Cyber Security Workforce Framework Cyber Defense Analysis role and attack detections of Mitre ATT&CK techniques. Learn to leverage standard security analysis signature and event-based technologies to identify a wide variety of common attack techniques and reveal hints of more advanced activity waiting to be discovered.
SOC Analyst Level 2
In this section you will learn to monitor information beyond the network and endpoints. You you will apply machine assisted statistical analysis across all security data event sources to establish environmental baselines and discover associated behavioral anomalies to identify advanced and emerging attacker techniques. You will focus on understanding the difference between potentially malicious activity and standard environment events across network, machine, application and endpoint OS data sources. All the while beginning to connect the indicators of compromise to the known threat actor behaviors.
SOC Analyst Level 3
In this section, you will apply advanced thought processes to unique problem sets, including hardware supply chain interdiction. Then, you will prioritize and aggregate the data into a SIEM to perform cross data and alert source correlation, ensuring you are only focused on the most dangerous and highest likelihood events. Finally, having tracked down the full chain of compromise for both the common and advanced threat actors you will learn to utilize workflow management system to aggregate triage information and elevate the case.
- Network Traffic Analysis
- Local Log and Authentication Analysis
- Application Event Analysis
- Endpoint OS Activity Analysis
- Common Adversary Attack Techniques
- Advanced Adversary Attack Techniques
- Statistical and Behavioral Anomaly Detection
- Correlation and Multi-Domain Event Detection in SIEM’s
- Security Operations Case Creation
- Viewers should have watched the Networking Fundamentals and Information Security Fundamentals skill path courses or have the equivalent knowledge and experience.
- Continuous Monitoring
- Incident Response
- Security Fundamentals
- Network Forensics
- Threat Hunting
- SOC Analyst
Learn with the best
