SOC Threat Analyst Practitioner (S-TA)

SOC Threat Analyst Practitioner Course Modules

Module 1 – Setting the Stage: The MDR SOC and the Threat Analyst

This module gives you a strategic vision of a current SOC (known as Next Generation SOC and lately, MDR), with a focus on the different ways an MDR SOC can be structured and the actions that must be taken to run and continuously improve a scalable and effective SOC based upon the SOC Implementation Model and SOC Maturity Model. You will  acquire the mindset to design an MDR SOC taking into account the relevant technology, processes, roles, tasks and services. In this module, you will also work on a business case, processing tasks in a virtual SOC via ITSM in a “Capture the Flag” format. You will be asked to identify a SOC’s business drivers, customers, roles and responsibilities, and  utilize MDR components and technologies in order to accomplish the SOC’s mission. Finally, you will create relevant SOC metrics.

1.1. SOC Services, Evolution to MDR and the Impact on the Threat Analyst Role
• Cloud SOC
• On-prem SOC
• Strategic SOC
1.2. MDR Service Operations
• ITIL Service Management
• Threat Modeling
• Threat Analysis
• Threat Hunting
• Threat Intelligence to discover, share, store and correlate Indicators of Compromise or targeted attacks
• Create and improve security monitoring and threat detection use cases
• Conduct blind spot detection assessments
• Automate SOC processes
• Respond rapidly to incidents
1.3. Business
• New drivers
• Customers
• New governance
• New privacy regulations
• SOC metrics
1.4. People
• New roles and hierarchy
• Training and knowledge management
• SOC career progression
• Assessing the SOC team

Frameworks and best practices for this module (Hands-on):
• SOC Maturity Model
• SOC Implementation Model
• The Library of Cyber Resilience Metrics
• NIST NICE

Module 2 – Attacker Tactics and Techniques In Depth

While junior and medior SOC analysts are expected to have a thorough understanding of Attacker Techniques, the Threat Analyst must master them! This module dives deep into the MITRE Att&ck Framework, MITRE Att&ck Navigator and Cyber Kill Chain to give you a full understanding of attacker tactics and techniques, and how to work with them in different environments. You will apply this knowledge to resolve problems during the course of the training.

2.1. MITRE Att&ck Framework (Hands-on)
2.2. MITRE Att&ck Navigator (Hands-on)
2.3. Cyber Kill Chain (Hands-on)

Module 3 – Key Toolset of the Threat Analyst: Introduction to SECO’s Virtual SOC

This module introduces you to the Virtual SOC you will be working in throughout the course. You will grasp how the tools and deployed technologies work together in this SOC environment, and work on a business case by processing some tasks.

3.1. ITSM and CMDB (Hands-on)
3.2. SOC Ticketing System (Hands-on)
3.3. SIEM (Hands on)
3.4. Threat Intelligence platform (Hands-on)
3.5. Packet capture and analysis
3.6. Automation tools
3.7. Incident Response tool
3.8. Security Automation tool and scripts
3.9. Rapid Response

Module 4 – Network and Asset Modeling, Log Ingestion Strategies, SIEM and Threat Investigation

This module starts with an exercise in Network and Asset Modeling and Risk Analysis. You will model the network you are assigned to monitor and protect in our Virtual SOC. You will label, classify and document the assets using the CMDB module on your ITSM, and perform a risk analysis on the assets. You will create log ingestion strategies in order to set up the best visibility to detect cyberattacks, and you will conduct detection assessments to help find detection blind spots. You will ingest several types of logs into the SIEM instances to enable quick searches and the investigation of events. Likewise, you will configure ITSM modules to define SOC services, investigate escalated threats and create alerts to proactively detect associated attacker techniques. Throughout the module, you will get assignments on a virtual ITSM system as in a real SOC. You will work on both Splunk and Elastic SIEM and interact with your SOC mates to complete investigation, escalation and hand-over activities.

4.1. Network Modeling, Asset Modeling, Risk Analysis (Hands-on)
4.2. Logging, Log sources, Log ingestion (Hands-on)
4.3. Blind Spot Detection Assessment (Hands-on)
4.4. ITSM and Defining SOC Services Conform to ITIL (Hands-on)
4.5. Threat Analysis (Hands-on)
• SIEM (Hands-on)
• Threat Analysis, correlation and Attack Techniques (Hands-on)
• Alerting, Reporting, Dashboarding and Escalating (Hands-on)

Frameworks and best practices for this module (Hands-on):
You will explore frameworks and best practices relevant to threat investigations, and you will use best-practice structure and naming convention when documenting investigations on the ticketing system. You will understand how the process and labelling convention work in different SOC areas, services, modules and technologies and how to scale them up.

• Cyber Kill Chain versus MITRE ATT&CK Framework
  • OODA loop
  • Diamond model of intrusion analysis
  • ITIL best practices for the SOC

Module 5 – Monitoring Use Cases and Threat Intelligence

Building on your knowledge of Attack Tactics and Techniques, you will create security monitoring and threat detection use cases in both Splunk and Elastic environments. Subsequently, you will use MaGMA UCF to measure, maintain, improve, scale and manage the SOC use case library. You will analyse SIGMA rule structure and create, maintain, scale and improve your own rules. Finally, you will dive into the Threat Intelligence process. You will use a real Threat Intelligence platform (MISP) in an authentic case scenario for situational awareness, threat investigation and threat detection. You will even extend your investigations to the fascinating world of the Dark Web to harvest threat intelligence. During the hands-on practice session, you will discover, share, store and correlate Indicators of Compromise of targeted attacks, financial fraud information, vulnerability information and threat actors. The hands-on session prepares you for a complex homework assignment you will complete after this module.

5.1. MITRE Att&ck Applied to Monitoring, Detection and Threat Intelligence
5.2. Security Monitoring and Threat Detection Use Cases (Hands-on)
• Security Monitoring
• Threat Detection
• Use Case Development
• MaGMA UCF
5.3. SIGMA Rules (Hands-on)
5.4. Threat Intelligence (Hands-on)
• Types
• Protocols
• Standards
• Feeds
• Platforms
• STIX/TAXII/OpenIoC
5.5. Threat Intelligence on the Dark Web (Hands-on)

Frameworks and best practices for this module (Hands-on):
• CSAN Threat Actors
• Threat intelligence protocols and standards
• Pyramid of Pain and TTP’s
• Cyber Kill Chain versus MITRE Att&ck
• OODA loop
• Diamond model of intrusion analysis
• Chatham House Rule.
• MaGMa and MaGMa UCF Tool
• MISP
• NIST NICE

Module 6 – Threat Hunting and Defense

Module 4 starts with TTPs and the MITRE Att&ck Framework in depth. In this module, you will collect IoCs and structure a full Threat Hunting campaign, where you will create your own hypotheses and either confirm or discard them after cross-correlating events, determining event context, and identifying and quantifying vulnerabilities based on Splunk, Elastic and MISP. You will track and document the entire process through your ITSM tool, just as next generation SOCs do. Once the threats are hunted, you will create your own rules to be shared and report the findings of your assignments. After performing in- depth analysis, you will translate your technical findings to a management summary and deliver a board-level presentation.

6.1. Pyramid of Pain (Hands-on)
6.2. TTPs (Hands-on)
6.3. Threat Hunting Methodologies (Hands-on)
• Cyber Threat Hunting Framework
• TaHiTI
• The Hunting Loop
6.4. The Hunt Matrix (Hands-on)
6.5. The Defense Chain
6.6. Detection Feedback
6.7. Advanced Persistence Defense
6.8. Snort/Zeek Rules (Hands-on)

Frameworks, best practices and references for this module:
• Threat intelligence protocols and standards
• Pyramid of Pain and The Hunt Loop
• Cyber Kill Chain versus MITRE ATT&CK Framework
• The Defense Chain
• OODA loop, Diamond model of intrusion analysis
• MaGMa, MaGMa UCF Tool
• MISP
• NIST NICE

Module 7 – Incident Response

Our last module is led by the PICERL Incident Response model and the NIST Computer Security Incident Handling Guide. In this module, you will first learn to evaluate the policies governing incident response, incident response plans, the procedures you should have in place and the tools and technologies you need to handle an incident. From there on, you will practice the incident response process including activities such as incident declaration, analysis, escalation and reporting. You will complete two exercises using your ITSM tool: You will manage an incident from preparation to post-incident evaluation. In the hands-on section you will use a platform that provides endpoint-driven information security tools and infrastructure to help you investigate, process and lead incident response in our virtual SOC.

This module also prepares you for a complex homework assignment. The homework assignment will be part of your certification exam, so make sure you complete it after finishing this module!

9.1. Preparation Phase (Hands-on)
• Policies
• IR Plan
• IR procedures
• Playbooks
9.2. Identification/Detection(Hands-on)
• Memory Analysis
• Disk Analysis
• Malware Analysis (YARA)
• Network Analysis
9.3. Containment
Systems
Network
Users
Services
Cloud
9.4. Eradication
• Systems
• Network
• Users
• Services
• Cloud
9.5. Recovery
• Systems
• Data
9.6. Lessons Learned (Hands-on)
9.7. Dissemination and Security Awareness

SOC Threat Analyst Practitioner Certification Exam

1. Homework assignment in CTF format
   The hands-on exercises on your last course day prepare you for a complex hands-on Capture the Flag homework assignment. This CTF homework assignment will be part of your certification exam. Make sure you finalise your assignment before you schedule your exam!
2. Exam
   The certification exam is conducted by the SECO-Institute, Europe’s leading security and continuity certification body. The exam voucher is included in the course fee, but you need to schedule your exam with the SECO-Institute. Upon successful completion of the exam, you will receive an exam certificate and an invitation to register your official SECO-SOC Threat Analyst Practitioner (S-SAP) certification title. By activating your certification title, you will become a certified professional in your field and you will receive a shareable digital badge to verify your competence to clients, employers and fellow professionals.• Exam language: English
   • Exam delivery: Online via a certified proctor
   • Exam format:
       • 10 multiple-choice questions
   • 5 open questions related to your CTF homework assignment
   • 1 case study
   • Duration: 120 minutes