קורס אנליסטים: קורס בקר SOC/IR

התוכנית נבנתה לצרכי ידע מעשי. לעומדים בדרישות התוכנית תוענק תעודה מטעם See-Security:

“Cyber SOC/IR Analyst”.

Module 5: Monitoring & Intrusion Data Analysis

1. Analyze data as part of security monitoring activities

• Heuristics
• Trend analysis
• Endpoint
• Network
• Log review
• Impact analysis
• E-mail analysis

2. Hardening controls to improve security

• Permissions
• Allow list (previously known as whitelisting)
• Blocklist (previously known as blacklisting)
• Firewall
• Intrusion prevention system (IPS) rules
• Data loss prevention (DLP)
• Endpoint detection and response (EDR)
• Network access control (NAC)
• Sinkholing
• Malware signatures – Development/rule writing
• Sandboxing
• Port security

3. Proactive threat hunting

• Establishing a hypothesis
• Profiling threat actors and activities
• Threat hunting tactics – Executable process analysis
• Reducing the attack surface area
• Bundling critical assets
• Attack vectors
• Integrated intelligence
• Improving detection capabilities

Module 6: Incident Response

1. Incident response process

• Response coordination with relevant entities
• Factors contributing to data criticality

2. Incident response procedure

• Preparation
• Detection and analysis
• Containment
• Eradication and recovery
• Post-incident activities

3. Potential indicators of compromise

Incident Response in action

• Network-related
• Host-related
• Application-related
• Real life Incident Response cases

Module 7: Windows Security Monitoring

Introduction to Windows Security Monitoring

• Windows Auditing Subsystem
• Security Monitoring Scenarios
• Local User Accounts
• Local Security Groups
• Microsoft Active Directory
• Active Directory Objects
• Authentication Protocols
• Operating System Events
• Logon Rights and User Privileges
• Windows Applications
• Filesystem and Removable Storage
• Windows Registry
• Network File Shares and Named Pipes

 Module 8: SIEM system

1. Getting to know the SIEM (Sentinel, QRadar, Splunk)

• Introduction to Azure Sentinel SIEM interface, dashboard, logs, devices
• Introduction to QRadar SIEM interface, dashboard, logs, devices
• Introduction to WatchDog-Splunk SIEM interface, dashboard, logs, devices
• Architecture Overview
• Devices and Settings
• Data Sources
• Event Analysis
• Aggregation
• Watch Lists and Policy Editor
• Query Filters
• Rule Correlation
• Alarms

2. Gaining Hands on experience

• Working on the SIEM – queries, detection, analysis
• Domain User activity, Anti-Virus, Perimeter Defense, firewall, Correlation Engine…

3. Detecting & Analyzing Attack scenarios

• SIEM scenarios and analysis

Module 0: Course Introduction

Welcome to SOC Analyst Course

• Message to the Student
• Welcome
• Today's Cybersecurity Analyst

Module 1: Information Security Basics 

Information Security Terminology

• Information Security
• CIA
• Defense in depth
• Information Security Solutions

Module 2: Security Operations

SOC Operation

• Legacy vs Modern Security Operations
• Three Pillars
• People
• SOC Structure
• Tiered SOC Model
• Tireless SOC Model
• Processes
• SOC Charter
• Onboarding
• Security information and event management (SIEM) review

Module 3: Monitoring & Analysis of Common Protocols

SIEM & Monitoring Basics

• Technology – SIEM
• McAfee SIEM Foundation
• Log Collection
• Main Data Sources
• Network
• Network Traffic by Layer
• Network Traffic Collection
• Endpoint Traffic
• SIEM Terms & Definitions
• Event Examples
• Example of Security Solutions Alerts
• Type of SIEM Alerts
• High Severity Alert Flow
• Technology – Incident Management System
• Threat Intelligence Platform
• SOAR
• Automation

Module 4: Threat & Vulnerability Management

Incident response process.

Utilization of threat intelligence to support organizational security

• Threat Intelligence and its importance
• Definitions
• Intelligence sources
• Confidence levels
• Indicator management
• Threat classification
• Collection
• Commodity malware
• Attack frameworks
• Threat research
• Threat modeling methodologies