CompTIA CySA+ Cybersecurity Analyst Certification (CS0-004)

Become a skilled cybersecurity analyst.

5 daysIntermediate14 modulesCS0-004CompTIA CySA+

Enrol or enquire →Ask on WhatsApp

Overview

About this course

Become a skilled cybersecurity analyst. You will analyse indicators of malicious activity, use SIEM, EDR and packet analysis tools, apply threat intelligence and hunting, manage vulnerabilities, respond to incidents and report effectively, preparing for CySA+ CS0-004.

What you'll learn

Explain system and network architecture concepts that support secure operations, including logging, identity, encryption, and modern frameworks (ZTNA, SASE, cloud-native).
Detect and analyze indicators of potentially malicious activity across networks, endpoints, cloud, and identity systems.
Use industry-standard tools and methods, SIEM, EDR/XDR, packet analyzers, and threat intelligence platforms, to determine malicious activity.
Apply threat intelligence and threat-hunting concepts to proactively identify and investigate threats.
Run a vulnerability management program: scanning, analysis, prioritization (CVSS and EPSS), and risk-based remediation.
Execute the incident response lifecycle from detection through containment, eradication, recovery, and post-incident activities.
Summarize AI use cases, security risks, and governance considerations within security operations.
Produce clear vulnerability and incident response reporting that drives stakeholder decisions.

Curriculum

14 modules

Logging concepts: ingestion, configuration, integrity and security, time synchronization, and retention
Operating system concepts, hardening, file structures, and critical processes
Infrastructure concepts: cloud-native, virtualization, containerization, and APIs
Network architecture: Zero Trust Network Access (ZTNA), SASE, and hybrid cloud
Identity and access management: PAM, authentication/authorization methods, and secrets management
Encryption, data protection, and OT/ICS/SCADA fundamentals
Security control types (physical, technical, administrative) and control functions

Network-based indicators: rogue devices, enumeration, and unexpected ports/traffic
Host-based indicators: resource spikes, unauthorized software, LOLBins, and file changes
Application- and cloud-based anomalies
Identity-based indicators: impossible travel and unauthorized access
Social engineering and Business Email Compromise (BEC)

Packet capture and analysis (Wireshark, tcpdump) and IDS/IPS engines (Snort, Suricata, Zeek)
SIEM, EDR/XDR, and threat intelligence platforms (TIPs)
File and reputation analysis; common log and file formats (JSON, XML, YAML, EVTX)
Scripting for analysis with Python, PowerShell, and shell

Threat actors, motivations, and TTPs; MITRE ATT&CK and the pyramid of pain
Indicators of compromise: collection, analysis, and application (atomic vs. behavioral)
Threat modeling (STRIDE), threat mapping, and cyber deception

Standardized playbooks and runbooks; SOAR and automation/orchestration
Data enrichment, alert and rule tuning, and dashboards
Tool integration via APIs, webhooks, and plug-ins

AI use cases in the SOC: log analysis, event correlation, documentation, investigations, and automation
AI security risks: hallucinations, data exposure, model poisoning, and malicious prompts (prompt injection)
AI governance and oversight: usage policies and legal/regulatory considerations

Asset discovery and inventory; scan planning for scope, sensitivity, segmentation, and regulatory needs
Internal vs. external, agent vs. agentless, credentialed vs. non-credentialed, active vs. passive scanning
Baseline and compliance scanning (PCI DSS, CIS, ISO 27000)

Interpreting scanner output; validating, consolidating, and deduplicating findings
Risk scoring with CVSS plus context; prioritization using the Exploit Prediction Scoring System (EPSS)
Handling false positives and tracking exceptions
Software supply chain security and Software Bill of Materials (SBOM)

Controls to mitigate: patching, configuration changes, and compensating controls
Change windows, rollback planning, retesting, and remediation validation
Risk-based remediation planning and inhibitors to remediation

Cyber kill chain, MITRE ATT&CK, and the Diamond Model of Intrusion Analysis
Testing guides and methodologies (OSSTMM, OWASP) for context

Lifecycle: detection, analysis, containment, eradication, and recovery
Evidence acquisition and digital forensics fundamentals
Root-cause analysis

Incident response plans, tooling, and playbooks
Tabletop exercises and training; business continuity and disaster recovery alignment
Post-incident review and lessons learned

Compliance reporting, action plans, and inhibitors to remediation
Metrics and KPIs; communicating risk to stakeholders

Incident declaration, escalation, and stakeholder identification
Incident reporting, root-cause summaries, and lessons-learned communication

Who it's for

Security analysts and SOC staff with Security+ level knowledge.

Before you start

Approximately three to four years of hands-on information security or related experience. CompTIA Security+ (or equivalent knowledge and experience) is recommended prior to attending.

Certification

Prepares for

CompTIA

CompTIA CySA+

CS0-004

1 course

View certification →

Diplomas

Part of these Alalamia diplomas

Alalamia Diploma in Cybersecurity Analysis

Let's plan your next step together.

Tell us the course or certification you have in mind and we'll send the outline, upcoming dates, fees and private-team options.

Talk to an advisor →WhatsApp