Introduction to Security Management

Introduction to the Security Operations

Center (SOC)

Why Do We Need a SOC?

Role of a SOC Analyst in Modern Cybersecurity

SOC Tiers and Responsibilities: Tier 1, Tier 2, Tier 3

Key SOC Technologies and Terminologies

SOC Workflow

SOC Infrastructure & Deployment Models

SOC & Threat Intelligence Integration

SOC Incident Handling & Response

Types of Cyber Threats: Malware, Ransomware, Phishing, Insider, Threats

Overview of Advanced Persistent Threats (APTs)

Understanding Attacks and Their Patterns Case Studies: MOVEit Data Breach, SolarWinds Supply Chain Attack

Real-World Case Studies & Lessons Learned

Emerging & Next-Gen Cyber Threats

Defending Against Cyber Threats

Attack Patterns & Techniques

Understanding Vulnerability Assessment

Types of Vulnerability Assessment

Vulnerability Management Lifecycle: Asset Identification, Vulnerability Assessment Risk, Assessment Remediation, Verification Monitoring

Common Vulnerabilities & Exploits

Vulnerability Exploit Techniques & Real-World Examples

Risk Assessment & Governance

Vulnerability & Patch Management Best Practices

Hands-On Labs & Practical Exercises

Understanding Log Sources: Firewalls, IDS/IPS, Web Servers, Endpoints

Hands-On with Centralized Logging Tool (Splunk)

Identifying Anomalies in Logs

Lab: Analyzing Apache Server Logs for Intrusion Attempts

Security Log Analysis & Threat Detection

Log Retention, Storage, & Compliance

Advanced Log Analytics & Automation

Lab: Log Analysis for Security Incidents

What is Threat Intelligence?

Why Do We Need Intelligence?

Threats, Threat Actors, APTs, and Global Campaigns

Types of Threats: Network-Level, Web Application-Level, Host-Level

Indicators of Compromise (IoCs) vs. Indicators of Attack (IoAs) vs. Precursors

Traffic Light Protocol (TLP)

Understanding the Pyramid of Pain

Practical Labs: Collecting IoCs, Exploring Threat Intelligence Platforms (e.g., Maltego, MISP), Checking IP/Domain Reputations, Analyzing Malicious Files

Introduction to Threat Hunting

Threat Hunting vs. Threat Detection

Relationship Between Incident Response and Threat Hunting

Threat Hunting Models: Hypotheses and Methodologies, Diamond Model of Intrusion Analysis, MITRE ATT&CK Framework

Practical Labs: Network Traffic Analysis (Wireshark, Network Miner), Endpoint Process Analysis, Memory Hunt – Volatility Framework, Monitoring and Detecting USB drives in Windows

Process Injection Lab in Wazuh

Data Sources for Threat Hunting

Threat Hunting Tools & Techniques

Advanced Threat Hunting Strategies

What is SIEM and Why Do We Need It?

SIEM Components: Security Information Management (SIM), Security Event Management (SEM)

SIEM Capabilities: Aggregation, Correlation, Alerts, Reporting

Hands-On with Splunk: Installation, Rule Writing & Alert Creation, Event Analysis

SIEM Use Cases & Threat Detection Scenarios

SIEM Integration & Automation

Advanced SIEM Concepts & Future Trends

Malware Analysis Basics

Static vs. Dynamic Analysis

Practical Labs: PE Analysis, YARA Rules, Traffic Analysis (Using Wireshark), Setting Up a Malware Lab, Anti-Sandboxing Techniques

Anti-Sandboxing & Evasion Techniques

Memory Forensics for Malware Analysis

Reverse Engineering Malware

Malware Detection & Threat Intelligence

Response (DFIR) – Part 1

Phases of Incident Response: Preparation, Detection, Containment, Eradication, Recovery

Incident Playbook Overview

Ticketing System

Dissecting Phishing Emails (Practical): Identifying Red Flags in Phishing Emails, URL Reputation Analysis, File Reputation Analysis

Hands-On Labs: Phishing & Email Forensics

Advanced Topics & Additional Labs

Real-World Case Studies & Simulation Exercises

Authentication Mechanisms: SPF, DKIM, DMARC

Hands-On Labs: Email Header Analysis, Analyzing Phishing Email Attachments, Extracting IoCs from Malicious Emails, Digital Forensics Case Study

Certification & Career Guidance

Advanced Access Control Mechanisms

Common Authentication & Access Control Attacks

Real-World Case Studies & Incident Analysis

Resume Building & Job Interview Preparation

Capstone Project: Real-world Cybersecurity Incident Investigation, Implementing Security Solutions using SIEM

Mock Exam & Final Assessment

Resume Building & Job Interview Preparation

Certification & Career Guidance