Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CyberOps (CBRFIR)

Voraussetzungen

Before taking this course, you should have:

• Familiarity with network and endpoint security concepts and monitoring
• Experience with network intrusion analysis
• An understanding of security policies and procedures
• Experience with risk management
• Experience with traffic and logs analysis
• Familiarity with APIs
• 2–3 years’ experience working in a Security Operations Center (SOC) environment (experience Tier 1, or new Tier 2)

Cisco recommends these learning offerings may help students meet these prerequisites:

• Performing CyberOps Using Cisco Security Technologies (CBRCOR)
• Understanding Cisco Cybersecurity Operations Fundamentals (CCNACBR)
• Splunk Fundamentals

Zielgruppe

This course is designed for the following roles:

• SOC analysts, Tiers 1–2
• Threat researchers
• Malware analysts
• Forensic analysts
• Computer Telephony Integration (CTI) analysts
• Incident response analysts
• Security operations center engineers
• Security engineers

Detaillierter Kursinhalt

• Introducing Incident Response and Forensic Analysis
• Describing Digital Forensics and Incident Response (DFIR) Guidelines and Associations
• Examining Threats and Vulnerability Frameworks
• Describing the Analytical Mindset
• Preparing for Incident Response and Responding to Threats
• Identifying Sources of Evidence
• Gathering Intelligence
• Examining Digital Forensics and Incident Response Tools
• Describing Detection and Analysis
• Describing Investigation and Detection
• Describing Digital Forensics
• Describing Breach Containment and Eradication
• Describing Post-Incident Activities