SEC450 Blue Team Fundamentals Security Operations and Analysis

SEC450 is an accelerated on-ramp for new cyber defense team members and SOC managers. This course introduces students to the tools common to a defender's work environment, and packs in all the essential explanations of tools, processes, and data flow that every blue team member needs to know.
Students will learn the stages of security operations: how data is collected, where it is collected, and how threats are identified within that data. The class dives deep into tactics for triage and investigation of events that are identified as malicious, as well as how to avoid common mistakes and perform continual high-quality analysis. Students will learn the inner workings of the most popular protocols, and how to identify weaponized files as well as attacks within the hosts and data on their network.
The course employs practical, hands-on instruction using a simulated SOC environment with a real, fully-integrated toolset that includes
* Security Information and Event Management (SIEM)
* An incident tracking and management system
* A threat intelligence platform
* Packet capture and analysis
* Automation tools
While cyber defense can be a challenging and engaging career, many SOCs are negatively affected by turnover. To preemptively tackle this problem, this course also presents research-backed information on preventing burnout and how to keep engagement high through continuous growth, automation, and false positive reduction. Students will finish the course with a full-scope view of how collection and detection work, how SOC tools are used and fit together, and how to keep their SOC up and running over the long term.
Hands-On Training
It is our belief that hands-on training is a crucial component of classroom learning, so each day of this course will include multiple hands-on exercises. To achieve the most realistic scenario possible, the class virtual machine is loaded with all the tools typically used in a SOC. Students will be introduced to the concepts, interconnections, and workflow associated with each of those tools. Throughout the class we will utilize a SIEM, threat intelligence platform, incident management and ticketing system, automation and orchestration tools, full packet capture, and analysis software, as well as multiple command line, open-source intelligence, and analysis tools. All of these tools have been set up and integrated to work with each other in order to re-create the workplace environment as closely as possible, allowing students to gain experience that they can directly translate to their own setup when they get back to the office.
Some of the highlights of what students will learn include
* How SIEM, threat intelligence platforms, incident management systems, and automation should connect and work together to provide a painless workflow for analysts
* Analysis of common alert types including HTTP(S), DNS, and email-based attacks
* Identification of post-exploitation attacker activity
* Mental models for understanding alerts and attack patterns that can help to effectively prioritize alerts
* How to perform high-quality, bias-free alert analysis and investigation
* How to identify the most high-risk alerts, and quick ways to verify them
* How logs are collected throughout the environment and the importance of parsing, enrichment, and correlation capability of the SIEM
* How to create and tune threat detection analytics to eliminate false positives
Homepage

https://www.sans.org/cyber-security-courses/blue-team-fundamentals-security-operations-analysis/