What exactly is a SOC and why are they important? This section will cover the high-level concept of a Security Operations Center and Enterprise Operations.

To defend a network, we must first understand the types of threats we need to defend against. This section will cover modern tactics, techniques, and procedures attackers are using from gaining initial access to a compromised network, moving around inside the network, and eventually exiling or causing damage.

Monitoring massive networks comprised of thousands of endpoints and hundreds of applications is a daunting task. To help make the process more approachable SOCs deploy various security tools to help monitor and identify potential attacks. This section will cover some of the more common tools used in SOCs.

SOC analysts spend a large amount of time analyzing network events and logs looking for oddities that might indicate an attack of some sort. There are lots of tools and techniques used to do this activity. This section will give a foundation for what event monitoring, indicators of compromise, and threat hunting are.

Everyday there are new vulnerabilities announced for software and hardware devices deployed across the globe. Attackers take these announcements and immediately look for ways to take advantage of them. A key component of enterprise defense operations is to reduce the potential attack surface with a process known as vulnerability management. Vulnerability management is an art all to itself and in this section, we will talk about some of the ways to help master the artform.

More and more organizations are in the news with reports of them being “hacked”. If you work at a SOC you will have security incidents that require urgent attention. This section will discuss the basic principles of incident response.

In this section we will summarize some of the major ideas and key takeaways that we have been learning about as well as discuss ways to continue to grow our knowledge.

This module underscores the importance of SIEM solutions, the key challenges of traditional SIEM and understanding of next generation SIEM.