EC-Council Certified SOC Analyst (CSA v2)

ابدأ مسيرتك في مركز العمليات الأمنية أو عزّزها. تفهم عمليات المركز والتهديدات ومؤشرات الاختراق، وتدير السجلات، وتكشف الحوادث وتفرزها، وتتعقّب التهديدات استباقياً، وتستجيب وتدعم التحقيقات الجنائية، استعداداً لشهادة CSA.

3 أياممتوسط8 وحداتCSA v2EC-Council Certified SOC Analyst (CSA)

سجّل أو استفسر ←اسأل عبر واتساب

نظرة عامة

المنهاج

المحتوى التقني أدناه معروضٌ باللغة الإنجليزية كما ورد في منهاج الدورة، حفاظاً على دقّة المصطلحات.

8 وحدات

Understand the principles of security management and identify the role of security operations in effective security management
Discuss Security Operations Center (SOC) and analyze its importance, capabilities, and functions.
Describe the SOC workflow flow and identify the People, Process and Technology involved in SOC
Compare different SOC models and their respective advantages and disadvantages
Explain the concept of SOC maturity models and evolution of SOC
Identify KPI's, challenges and implement best practices for effective SOC operations and management

Understand Cyber threats and its impact on Cyber Security
Understand Network Attack Tactics, Techniques, and Procedures (TTPs)
Understand Host Attack Tactics, Techniques, and Procedures (TTPs)
Understand Application Attack Tactics, techniques, and Procedures (TTPs)
Understand Social Engineering Attack Tactics, Techniques, and Procedures (TTPs)
Understand Email Attack Tactics, Techniques, and Procedures (TTPs)
Understand Insider Attack Tactics, Techniques, and Procedures (TTPs)
Understand and Recognize the Indicators of Compromise (IoCs) of Various Attacks
Understanding Attack Methodology and Frameworks

Understand Log Management its importance and approaches
Understand and Analyze Local Logging Practices: Windows, Linux and Mac Logs
Understand and Analyze Local Logging Practices: Firewall and Router Logs
Understand and Analyze Local Logging Practices: Web Server, Database, Email
Understand and Implement Centralized Logging

Understand the Importance and Architecture of Security Information and Event Management (SIEM)
Understand Types of SIEM Solutions and their advantages and Disadvantages
Understand Deploying a SIEM solution
Understand SIEM Use case Management
Learn Incident Detection with SIEM
Understand the use of AI for generating SIEM rule
Understand Handling Alert Triaging and Analysis
Understand Visualization and Dashboard Management in SOC
Understand SOC Reports

Learn Fundamental Concepts of Threat Intelligence
Understand Types and Strategies of Threat Intelligence
Understand the Various Threat Intelligence Sources
Understand Threat Intelligence Platforms (TIP)
Understanding Threat Intelligence-Driven SOC and Its Benefits to SOC Team
Demonstrate the Use of Threat Intelligence Use Cases to Enhance Incident Response
Understand Threat Hunting and its Significance
Understand Threat Hunting Frameworks
Demonstrate Threat Hunting using PowerShell, Yara, and Threat Hunting Tools

Understand about Incident Response
Learn Various Phases in Incident Response Process
Learn to Responding to Network Security Incidents
Learn to Responding to Application Security Incidents
Learn to Responding to Email Security Incidents
Learn to Respond to Insider Incident
Learn to Respond to Malware Incidents
Understanding the Role of SOC Playbooks in Incident Response
Understand Enhanced Incident Response using Endpoint Detection and Response (EDR) / Extended Detection and Response (XDR)

Understand about Forensic Investigation
Investigating Network Security Incidents
Learn to Investigate Application Security Incidents
Learn to Investigate Email Security Incidents
Learn to Investigate Insider Incidents
Understand Malware Analysis
Learn to Perform Static Malware Analysis
Learn to Perform Dynamic Malware Analysis

Introduction to Cloud SOC
Understand Azure SOC Architecture, Microsoft Sentinel and Security Tools
Understand AWS SOC Architecture, AWS Security Hub and security tools
Understand Google Cloud Platform (GCP) SOC Architecture, Security Command Center, Chronicle and security tools

لمن هذه الدورة

محلّلو مراكز العمليات الأمنية في المستويين الأول والثاني، والطامحون إلى هذا الدور.