مهدی میرسلطانی

• پیشرفته
• مسیر آبی
• ۷ درس

دربارۀ این دوره

مخاطبان

• تحلیل‌گران سطح ۲ و ۳ (Tier 2/3) مراکز عملیات امنیتی (SOC)
• مهندسان تشخیص تهدید (Detection Engineers)
• مهندسان زیرساخت و امنیت که به دنبال یادگیری اتوماسیون هستند.

پیش‌نیازها

• تجربه کاری در عملیات بررسی هشدارها، تحقیقات پایه (SOC).
• آشنایی کامل با خط فرمان لینوکس (Linux CLI).
• آشنایی مقدماتی با اسکریپت‌نویسی (پایتون یا پاورشل).

• Foundations: Environment & Workflow Engineering
  • SETUP LAB | Orient to the course, start the lab environment, and confirm that the required services are ready
  • SEEDED LAB | Build the first API workflow and test authentication, retry/backoff, logging, and four injected failure modes
• Alert Enrichment & Triage Automation
  • BASELINE EXERCISE | Investigate a sample alert manually, record the time, and preserve the result for later comparison.
  • SEEDED LAB | Enrich an IOC on ingest, score the context, and identify a deliberately confident but incorrect verdict.
  • SEEDED LAB | Route enriched alerts according to severity and the defined response path.
  • SEEDED LAB | Convert a qualifying alert into a durable, resumable, and auditable case
  • SEEDED LAB | Prepare a phishing alert and its available evidence for automated investigation
  • SEEDED LAB | Tag the reason for a false positive so detection tuning and reporting can reuse the analyst decision
• Investigation Automation
  • SEEDED LAB | Run an end-to-end phishing investigation from alert intake to a documented case outcome.
  • SEEDED LAB | Automate initial malware triage and preserve the resulting indicator and investigation context.
  • SEEDED LAB | Build a cross-tool timeline while handling a silent endpoint agent and a missing CMDB record.
• Vulnerability & Security Metrics Automation
  • SEEDED LAB | Prioritize vulnerability findings by operational risk rather than scanner severity alone.
  • SEEDED LAB | Build a real-time SOC metrics dashboard and compare its results with the manual baseline from Section 2.
• Detection Engineering & Detection-as-Code
  • SEEDED LAB | Create a detection-as-code CI/CD pipeline that versions, tests, and promotes detection rules
  • SEEDED LAB | Use recorded false-positive reasons to close the feedback loop for detection tuning
  • LIVE LAB | Run an attack simulation against the range and verify that the detection fires as expected
• Advanced Threat Hunting & Remediation Automation
  • INSTRUCTOR DEMONSTRATION | Translate threat intelligence into practical hunt queries
  • LIVE LAB | Sweep the full fleet for a confirmed IOC immediately after it is validated
  • SEEDED LAB | Apply graduated, risk-tiered auto-remediation with reversible actions and rollback designed in
• Capstone: Cross-Platform Security Orchestration
  • LIVE CAPSTONE | Respond to an unannounced, multi-stage intrusion from initial detection through investigation and remediation
  • WRAP-UP | Review a worked governance example and the role specializations that can follow this course