❖ Why do we need Security?
❖ CIA Triad
❖ Concept of AAA
❖ Hacking Concepts
❖ Domains of Security
❖ Ethical Hacking Phases
❖ Types of Attacks
❖ Network Fundamentals
     ➢ NOC vs SOC
     ➢ The OSI Model
     ➢ Network Devices
     ➢ Network Connection Endpoints/ Tools – Firewall, IDS, IPS, VPN,
         Switches, Routers Ports and Services etc
❖ Windows Operating System Fundamentals [Practical]
     ➢ Investigating Windows Operating System
     ➢ Windows Event Logs
     ➢ Windows Registry
     ➢ Scheduled Tasks
     ➢ File Analysis
     ➢ SysInternals Suite
     ➢ Command Prompt
     ➢ Sysmon (System Monitor)
❖ Linux Operating System Fundamentals [Practical]
     ➢ Linux Directory Services
     ➢ Most useful Linux Commands in SOC
     ➢ Events Logs in Linux
     ➢ Linux System Services
❖ OS Level Vulnerabilities etc

❖ Why do we need SOC?
❖ What is SOC?
❖ Functions of SOC
❖ SOC Models & Types
❖ SOC Teams & Roles
❖ Incidents vs Events
❖ True vs False Incident Categories
❖ Concept of Logging
     ➢ Local Logging vs Centralized Logging
❖ Log Management & Log Analysis
     ➢ Log Management needs
     ➢ Concept of Log Analysis
     ➢ Web Server Logs
     ➢ Firewall Logs
     ➢ SSH Logs
     ➢ Windows Event Logs
     ➢ Log Analysis [Practical]
❖ SOC Workflow: ITSM Workflow
❖ ITSM Tools: Service Now, JIRA, BMC, Request Tracker, etc

❖ Why do we need SIEM?
❖ What is SIEM?
     ➢ Security Information Management (SIM)
     ➢ Security Event Management (SEM)
❖ SIEM guidelines and architecture
❖ SIEM Capabilities: Aggregation, Correlation, Reporting, Storage, Alerts, etc.
❖ Using Open Source & Enterprise SIEM tools
     ➢ Section Introduction
     ➢ Installing Setup
     ➢ UI Navigation
     ➢ Search Queries using SPL & others
     ➢ Creating Alerts & Dashboard

❖ What is Threat?
❖ Why do we need Intelligence?
❖ Introduction to Threat Intelligence
❖ Threats, Threat Actors, APTs & Global Campaigns
     ➢ Network Level Threats
     ➢ Web App Level Threats
     ➢ Host Level Threats
❖ IOCs vs IOA vs Precursors
❖ Traffic Light Protocol (TLP)
❖ Pyramid of Pain [Practical]
❖ Collecting Threat Intelligence [Practical]
     ➢ Paid vs Open-Source Intelligence Gathering
❖ Types of Threat Intelligence
     ➢ Strategic Threat Intelligence
     ➢ Operational Threat Intelligence
     ➢ Tactical Threat Intelligence
     ➢ Technical Threat Intelligence
❖ Enhanced Detection with Threat Intelligence
❖ Maltego, MISP, STIX, TAXII, etc. [Practical]

❖ Forensics Fundamentals
     ➢ File Systems
     ➢ Hard Disk Drive Basics
     ➢ Forensics Process [Practical]
     ➢ Digital Evidence and Handling
     ➢ Order of Volatility
     ➢ Chain of Custody
     ➢ Hashing & Integrity
❖ Email Forensics
     ➢ How Electronic Mail Works
     ➢ Anatomy of an Email
     ➢ What is Phishing?
     ➢ Types of Phishing
     ➢ URL Shortening
     ➢ Business Email Compromise
❖ Analysing Phishing Emails [Practical]
❖ Incident Response
     ➢ Introduction to Incident Response
     ➢ What is an Incident Response?
     ➢ Why is IR Needed?
     ➢ Incident Response Lifecycle – NIST SP 800 61r2
     ➢ Incident Response Plan: Preparation, Detection & Analysis, Containment,
Eradication, Recovery, Lessons Learned
     ➢ Incident Response and Security Operations Integration
     ➢ Case Study: Cyber Kill Chain in Incident Response
❖ Lockheed Martin Cyber Kill Chain
     ➢ What is it, why is it used ?
     ➢ Case Study: Monero Crypto-Mining
❖ MITRE ATT&CK Framework [Practical]
    ➢ What is it, why is it used ?
    ➢ Matrices in Mitre     ➢ Mapping Data with Mitre
    ➢ Case Study 1: APT3
    ➢ Case Study 2: OilRig
    ➢ SIEM vs APT Groups

❖ Anomalies behavior of a Network
❖ SOC Components
❖ Foundation EndPoint
❖ Foundation Application
❖ Telemetry & Log Analysis of non-security events
❖ Security Telemetry, Events and Alerts
❖ Network, Endpoint Telemetry- Events & Alerts Tuning
❖ Incident Declaration & Triage
❖ Enterprise Attack Vector
❖ Investigation Approach
     ➢ Incident Response Support
     ➢ Case Studies and Capstone Project
     ➢ Vulnerability Management
     ➢ All Stages of SOC Operations
     ➢ Documentation & Presentation
     ➢ Labs/Projects