SOC Tier 1 Operations

درباره‌ی این دوره

این دوره به چه افرادی توصیه می‌شود؟

• تحلیل‌گران و مهندسین لایه‌ی اول SOC
• مهندسین امنیت شبکه و زیرساخت
• مشاورین امنیت سایبری
• کارشناسان ردیابی مهاجمین

برای حضور در این دوره چه دانش‌هایی باید داشته باشم؟

• آشنایی با مفاهیم انواع حملات سایبری
• آشنایی با مفاهیم سیستم‌عامل‌های ویندوز و لینوکس
• آشنایی با پروتکل‌های TCP/IP
• آشنایی با مفاهیم و تعاریف تحلیل وقایع و لاگ
• آشنایی با مفاهیم شبکه

• Data is everything
  • Introduction Event, Alert, Incident
  • Type of Incident
  • When Alert Is Incident?
  • Structure of Alert
• SOC Introduction
  • Human Position
  • Tiers Tasks
  • Triage Officer
  • Incident Handling Process
  • Incident Response Process
• SIEM Introduction
  • What Is SIEM?
  • Goal of SIEM
  • Tactical SIEM VS Compliance SIEM
  • Structure
• Network Input Feed
  • Network Input Feed
    • Device Logging
    • Network Extract Logging
    • Zeek and Deployment Location
    • DNS
    • Suricata NIDS
    • NetFlow Generator and Parser
    • HTTP
    • HTTPS
    • SMTP
• Log Enrichment
  • Tagging
  • One Top Million
  • Indicators Of Compromise (IOC)
  • Alien Vault (OTX)
  • Frequency Score
  • Geo Location
• Endpoint Input Feed
  • Endpoint Input Feed
    • Types Of Endpoints
    • Windows Logging
    • Linux Logging
  • Strategy of collection
    • Server VS Desktop
    • How We Should Collect?
    • Noise Prevention and Filtering
• Endpoint Analysis
  • Event OF Interest
    • How Well do We Know ourselves?
    • EOI Before Compromise
    • Finding Signs of Exploitation
    • Find Signs of Internal Reconnaissance
    • Finding Persistence
    • Privilege Escalation
    • Establishing a Foothold
    • Cleaning up Tracks
  • Credential Theft and reuse
    • Multiple failed logons
    • Unauthorized Account Use
  • Monitor PowerShell
    • Configure PowerShell Logging
    • Identify Obfuscation
    • Identify Modern Attacks
• Baseline data
  • Network Data (from NetFlow, Firewalls, etc.)
    • Use Outbound Flows to Discover Unauthorized Use OR Assets
    • Compare Expected Inbound/Outbound Protocol
    • Find Persistence AND Beaconing
    • Utilize Geolocation and Reverse DNS Lookups
    • Establish Device-TO-Device Relationships
    • Identify Lateral Movement
    • Configure Outbound Communication Thresholds
  • Monitor Logons Based on Patterns
    • Time-based
    • Concurrency of logons
  • Endpoint Baseline Monitoring
    • Configure Enterprise-Wide Baseline Collection
    • Large Scale Persistence Monitoring
    • Finding Abnormal Local User Accounts
    • Discover Dual-Homed Devices
• Tactical SIEM Detection & Post Mortem Analysis
  • Centralize NIDS and HIDS Alerts
  • Analyze Endpoint Security Logs
    • Provide Alternative Analysis Methods
    • Configure Tagging to Facilitate Better Reporting
  • SIEM Tripwires
    • Configure Systems to Generate Early Log Alerts After Compromise
    • Identify File and Folder Scan Activity
    • Identify User Token Stealing
    • Operationalize Virtual Honeypots with Central Logging
    • Allow phone home tracking
  • Post Mortem Analysis
    • Re-analyze Network Traffic
    • Identify Unusual Time-Based Activity
    • Use Threat Intel to Reassess previous Data Fields Such as User-Agents
    • Utilize Hashes in Log to Constantly Re-evaluate for Known Bad Files

گواهینامه‌ی دوره