SEC450: Blue Team Fundamentals: Security Operations and Analysis
About This Course
This course is designed from the ground up to be the most comprehensive SOC analyst training course available. By providing a detailed explanation of the mission and mindset of a modern cyber defense operation, this course will jumpstart and empower those on their way to becoming the next generation of blue team members. Designed for teams of all types, SEC450 provides hands-on with the tools and techniques required to quickly detect and halt advanced cyberattacks.
What You'll Learn
• Security Data Collection - How to make the most of security telemetry including endpoint, network, and cloud-based sensors
• Automation - How to identify the best opportunities for SOAR platform and other script-based automation
• Efficient Security Process - How to keep your security operations tempo on track with in-depth discussions on what a SOC or security operations team should be doing at every step from data generation to detection, triage, analysis, and incident response
• Quality Triage and Analysis - How to quickly identify and separate typical commodity attack alerts from high-risk, high-impact advanced attacks, and how to do careful, thorough, and cognitive-bias free security incident analysis
• False Positive Reduction - Detailed explanations, processes, and techniques to reduce false positives to a minimum
• SOC Tools - including hands-on exercises demonstrating:
• How to collect, organize, and use relevant threat data in a Threat Intelligence Platform (TIP)
• Principles of success for endpoint security data collection whether you use a SIEM, EDR, or XDR
• Alert Triage - How to quickly and accurately triage security incidents, using clever data correlation and enrichment techniques that will immediately surface and sort true positives from false positives
• How to best use incident management systems to effectively analyze, document, track, and extract critical metrics from your security incidents
• Crafting automation workflows for common SOC activities, relieving analysts of boring tasks and freeing up time for better threat hunting and detection engineering
• Burnout and Turnover Reduction - Informed with both scientific research and years of personal experience, this class teaches what causes cyber security analyst burnout and how you and your team can avoid it by understanding the causes and factors that lead to burnout.
Entry Requirements
A basic understanding of TCP/IP and general operating system fundamentals is needed for this course. Being accustomed to the Linux command-line, network security monitoring, and SIEM solutions is a bonus. Some basic entry-level security concepts are assumed.
Participants should be proficient in written and spoken English. There are no minimum entry requirements for years of experience in the domain, education level or age group; but participants should possess the relevant prerequisite skills mentioned above.