Practical Network Defense & Threat Triaging

Course Overview

This hands-on course teaches essential techniques for identifying and analyzing security compromises within corporate IT environments. You will inspect captured network traffic, analyze event logs, and triage potential malware infections step-by-step.

What You Will Learn

• Capture and inspect live network packet captures to isolate suspicious activity.
• Identify common attack signatures across firewalls, servers, and endpoint systems.
• Establish clear threat-triaging priorities during active security incidents.
• Write clear incident reporting documentation for operational response teams.

Syllabus Breakdown

• Module 1: Traffic Analysis & Packet Inspection: Inspecting PCAP files, isolating protocols, and identifying anomaly patterns.
• Module 2: Log Analysis & Detection: Reviewing Windows event logs, Linux syslog outputs, and firewall entries.
• Module 3: Threat Triaging Workflows: Severity scoring, initial containment steps, and scope determination.
• Module 4: Incident Reporting & Forensics: Chain of custody, basic artifact extraction, and post-incident documentation.

Who This Is For

IT support staff, junior SOC analysts, and network administrators transitioning to defensive cybersecurity roles.