MODULE 1

Security Operations and Management

Module Introduction

Welcome to Module One of your Certified Security Operations Centre Analyst Level 2 course! In this module, we will explore Security Operations and Management. You will learn the principles, capabilities, and functions of a SOC, and how to manage SOC operations effectively.

Think of this module as understanding the engine room of cybersecurity defence. By the end of this module, you will understand how a SOC operates, how it evolves, and what makes it successful.

Learning Objectives

By the end of this module, you will be able to:

• Understand SOC principles, capabilities, and functions.
• Describe the SOC workflow and the People, Process, Technology framework.
• Explain SOC models and maturity evolution.
• Identify Key Performance Indicators (KPIs) and SOC challenges.
• Apply best practices for effective SOC operations.

---

Warm‑up Story

Amara's SOC Transformation

Amara was a Tier 1 SOC analyst at a bank in Lagos. She was good at her job, but she wanted to move up to Tier 2. She knew she needed to understand how the SOC operated as a whole.

She studied the People, Process, Technology framework. She learned about SOC maturity models and how to measure performance with KPIs. She also learned about common SOC challenges and how to overcome them.

Within a year, Amara was promoted to Tier 2 analyst. She now leads investigations and mentors junior analysts. She learned that understanding SOC operations is the foundation of a successful career.

Main Lessons

Lesson 1: What is a Security Operations Centre (SOC)?

Definition: A Security Operations Centre (SOC) is a centralized team responsible for monitoring, detecting, investigating, and responding to cybersecurity incidents.

Why it is important: The SOC is the heart of an organization's cybersecurity defence, providing 24/7 protection against threats.

• Real‑life example: A bank uses a SOC to monitor for fraud and cyber attacks.
• School example: A school uses a SOC to protect student data.
• Home example: A family uses a security system to monitor their home.
• Nigerian example: A telecom company uses a SOC to protect its network.

Lesson 2: SOC Principles

Definition: SOC principles are the foundational beliefs that guide SOC operations.

• Proactive Defence: Actively seek out threats before they cause damage.
• Continuous Monitoring: Monitor systems 24/7 to detect threats.
• Rapid Response: Respond quickly to minimize impact.
• Collaboration: Work with other teams and stakeholders.
• Continuous Improvement: Always learn and improve.

Lesson 3: SOC Capabilities and Functions

Definition: SOC capabilities are the things the SOC can do. Functions are the specific activities it performs.

• Capabilities:
  • Monitoring: Watching for threats.
  • Detection: Identifying threats.
  • Investigation: Analysing threats.
  • Response: Taking action.
  • Recovery: Restoring operations.
• Functions:
  • Alert Triage: Prioritizing alerts.
  • Incident Investigation: Analysing incidents.
  • Threat Hunting: Proactively searching for threats.
  • Reporting: Documenting findings.

Lesson 4: SOC Workflow

Definition: SOC workflow is the process of handling security events from detection to resolution.

• Detection: An alert is triggered.
• Triage: The alert is prioritised.
• Investigation: The alert is analysed.
• Response: Action is taken.
• Closure: The incident is resolved.
• Lessons Learned: The incident is reviewed.

Lesson 5: People, Process, Technology Framework

Definition: The People, Process, Technology (PPT) framework is a model for building effective SOCs.

• People: The analysts who operate the SOC.
• Process: The procedures and workflows.
• Technology: The tools and systems.

Lesson 6: SOC Models

Definition: SOC models describe different ways to structure and operate a SOC.

• Internal SOC: Staffed by the organization's own employees.
• Outsourced SOC: Managed by a third-party provider.
• Hybrid SOC: A combination of internal and outsourced resources.
• Federated SOC: Multiple SOCs working together.

Lesson 7: SOC Maturity Evolution

Definition: SOC maturity describes how advanced a SOC is.

• Level 1 – Initial: Reactive, ad-hoc processes.
• Level 2 – Repeatable: Basic processes in place.
• Level 3 – Defined: Formalized processes.
• Level 4 – Managed: Proactive and automated.
• Level 5 – Optimized: Continuous improvement.

Lesson 8: Key Performance Indicators (KPIs)

Definition: KPIs are metrics used to measure SOC performance.

• MTTD: Mean Time to Detect.
• MTTR: Mean Time to Respond.
• Alert Volume: Number of alerts received.
• False Positive Rate: Percentage of false alerts.
• Incident Closure Rate: Percentage of incidents resolved.

Lesson 9: SOC Challenges

Definition: SOC challenges are common problems that SOCs face.

• Alert Fatigue: Too many alerts leading to missed threats.
• Staff Shortage: Not enough skilled analysts.
• Tool Sprawl: Too many tools that don't integrate.
• Budget Constraints: Limited resources.
• Evolving Threats: Attackers are always changing.

Lesson 10: Best Practices for SOC Operations

Definition: Best practices are guidelines for effective SOC operations.

• Automate repetitive tasks: Use SOAR to reduce manual effort.
• Measure performance: Track KPIs to identify areas for improvement.
• Invest in training: Develop analysts' skills.
• Integrate tools: Ensure tools work together.
• Stay updated: Keep up with new threats and technologies.

Key Vocabulary

Important Concepts

• A SOC is the heart of cybersecurity defence.
• SOC principles include proactive defence, continuous monitoring, rapid response, collaboration, and continuous improvement.
• SOC capabilities include monitoring, detection, investigation, response, and recovery.
• The PPT framework consists of People, Process, and Technology.
• SOC maturity evolves from reactive to proactive and optimized.
• KPIs measure SOC performance.

Step-by-Step Explanations

How to Set Up a SOC

1. Define the SOC's mission and objectives.
2. Assess resources (people, budget, technology).
3. Design the SOC structure and processes.
4. Select and implement security tools.
5. Hire and train analysts.
6. Establish workflows and playbooks.
7. Monitor and continuously improve.

How to Measure SOC Performance

1. Identify key metrics (MTTD, MTTR, alert volume).
2. Collect data from SIEM and other tools.
3. Analyze the data.
4. Create reports and dashboards.
5. Use the data to improve.

Real-Life Examples

• In a business: A company uses KPIs to track SOC performance.
• In a school: A school uses the PPT framework to build a SOC.
• In a hospital: A hospital uses a SOC to protect patient data.
• In Nigeria: A bank uses a SOC to detect fraud.

Nigerian Examples

• A bank in Lagos uses KPIs to track SOC performance.
• A telecom company in Abuja uses the PPT framework.
• A hospital in Kano uses a SOC to protect patient data.
• A government agency in Enugu uses a SOC for cybersecurity.

Fun Examples Children Can Relate To

• A security guard watching cameras (SOC).
• A coach leading a team (SOC management).
• A scoreboard showing points (KPIs).
• A team improving over time (SOC maturity).

Everyday Examples

• A home security system (SOC).
• A family emergency plan (SOC management).
• A fitness tracker (KPIs).
• A team improving over time (SOC maturity).

Teacher Notes

• Emphasize the importance of SOC operations.
• Use real-world examples to illustrate concepts.
• Discuss the PPT framework and its importance.
• Encourage students to think about SOC challenges and how to overcome them.

Parent Tips

• Help your child understand the importance of security operations.
• Discuss how organizations protect themselves.
• Encourage them to think about SOC challenges.
• Support their interest in cybersecurity careers.

Interesting Facts

• The first SOCs were established in the 1990s.
• SOCs operate 24/7 to protect organizations.
• Many SOCs use AI to detect threats.
• The average cost of a data breach is over $4 million.

Did You Know?

Remember This

• A SOC is the heart of cybersecurity defence.
• SOC principles include proactive defence, continuous monitoring, rapid response, collaboration, and continuous improvement.
• SOC capabilities include monitoring, detection, investigation, response, and recovery.
• The PPT framework consists of People, Process, and Technology.
• SOC maturity evolves from reactive to proactive and optimized.
• KPIs measure SOC performance.

Common Mistakes

• Not investing in people: Analysts are the most important asset.
• Not measuring performance: Without metrics, you cannot improve.
• Not automating: Manual tasks are inefficient.
• Ignoring challenges: Challenges like alert fatigue must be addressed.
• Not evolving: SOCs must continuously improve.

Best Practices

• Invest in people.
• Measure performance.
• Automate repetitive tasks.
• Address challenges proactively.
• Continuously improve.

Comparison: SOC Models

Model	Description	Best for
Internal	Staffed by employees	Large enterprises
Outsourced	Managed by a third party	Small businesses
Hybrid	Combination of both	Flexible needs
Federated	Multiple SOCs working together	Large organizations

Comparison: SOC Maturity Levels

Level	Description	Characteristics
1 – Initial	Reactive	Ad-hoc, no formal processes
2 – Repeatable	Basic	Some processes in place
3 – Defined	Formal	Standardized processes
4 – Managed	Proactive	Automated and proactive
5 – Optimized	Optimized	Continuous improvement

End-of-Module Summary

Congratulations! You have completed Module One. You now know:

• What a SOC is and why it is important.
• SOC principles, capabilities, and functions.
• The SOC workflow.
• The People, Process, Technology framework.
• SOC models and maturity evolution.
• Key Performance Indicators (KPIs) and SOC challenges.
• Best practices for SOC operations.

You are now ready to move on to Module Two, where you will learn about Cyber Threats, IoCs, and Attack Methodology.

Frequently Asked Questions

1. What is a SOC? A Security Operations Centre.
2. What are SOC principles? Proactive defence, continuous monitoring, rapid response, collaboration, and continuous improvement.
3. What are SOC capabilities? Monitoring, detection, investigation, response, and recovery.
4. What is the PPT framework? People, Process, Technology.
5. What are SOC models? Internal, outsourced, hybrid, and federated.
6. What is SOC maturity? The evolution of SOC capabilities.
7. What are KPIs? Key Performance Indicators.
8. What are SOC challenges? Alert fatigue, staff shortage, tool sprawl, budget constraints, and evolving threats.
9. What are best practices for SOC? Automation, measurement, training, integration, and staying updated.
10. Why is the SOC important? It protects organizations from cyber threats.

Review Questions

1. What is a SOC?
2. What are SOC principles?
3. What are SOC capabilities?
4. What is the SOC workflow?
5. What is the PPT framework?
6. What are SOC models?
7. What is SOC maturity?
8. What are KPIs?
9. What are SOC challenges?
10. What are best practices for SOC?
11. What is the difference between internal and outsourced SOC?
12. What is the difference between Level 1 and Level 5 SOC maturity?
13. What is MTTD?
14. What is MTTR?
15. Why is the SOC important?

Fill-in-the-Blank Exercises

1. A __________ is a Security Operations Centre.
2. SOC principles include proactive defence, continuous monitoring, rapid response, collaboration, and __________.
3. SOC capabilities include monitoring, detection, investigation, response, and __________.
4. The PPT framework consists of People, Process, and __________.
5. SOC models include internal, outsourced, hybrid, and __________.
6. SOC maturity evolves from reactive to proactive and __________.
7. KPIs stand for __________ Indicators.
8. MTTD stands for __________ Time to Detect.
9. MTTR stands for __________ Time to Respond.
10. Best practices for SOC include automation, measurement, training, integration, and __________.

True or False

1. A SOC is the heart of cybersecurity defence. (True)
2. SOC principles include reactive defence. (False)
3. SOC capabilities include monitoring and detection. (True)
4. The PPT framework consists of People, Process, and Policies. (False)
5. An internal SOC is managed by a third party. (False)
6. SOC maturity evolves from reactive to optimized. (True)
7. KPIs are not important for SOCs. (False)
8. MTTD measures the time to detect an incident. (True)
9. Alert fatigue is a challenge for SOCs. (True)
10. Best practices for SOC include ignoring challenges. (False)

Multiple Choice Questions

1. What is a SOC?
   a) A Security Operations Centre b) A type of software c) A hardware device d) A threat
   Answer: a
2. What are SOC principles?
   a) Proactive defence, continuous monitoring, rapid response, collaboration, continuous improvement b) Only proactive defence c) Only continuous monitoring d) None
   Answer: a
3. What are SOC capabilities?
   a) Monitoring, detection, investigation, response, recovery b) Only monitoring c) Only detection d) None
   Answer: a
4. What is the SOC workflow?
   a) Detection, triage, investigation, response, closure, lessons learned b) Only detection c) Only response d) None
   Answer: a
5. What is the PPT framework?
   a) People, Process, Technology b) People, Policies, Technology c) Process, Policies, Technology d) None
   Answer: a
6. What are SOC models?
   a) Internal, outsourced, hybrid, federated b) Only internal c) Only outsourced d) None
   Answer: a
7. What is SOC maturity?
   a) The evolution of SOC capabilities b) A type of software c) A hardware device d) A threat
   Answer: a
8. What are KPIs?
   a) Key Performance Indicators b) A type of software c) A hardware device d) A threat
   Answer: a
9. What are SOC challenges?
   a) Alert fatigue, staff shortage, tool sprawl, budget constraints, evolving threats b) Only alert fatigue c) Only staff shortage d) None
   Answer: a
10. What are best practices for SOC?
    a) Automation, measurement, training, integration, staying updated b) Only automation c) Only measurement d) None
    Answer: a
11. What is the difference between internal and outsourced SOC?
    a) Internal is staffed by employees; outsourced is managed by a third party b) They are the same c) Outsourced is staffed by employees; internal is managed by a third party d) None
    Answer: a
12. What is the difference between Level 1 and Level 5 SOC maturity?
    a) Level 1 is reactive; Level 5 is optimized b) They are the same c) Level 1 is optimized; Level 5 is reactive d) None
    Answer: a
13. What is MTTD?
    a) Mean Time to Detect b) Mean Time to Respond c) Mean Time to Attack d) None
    Answer: a
14. What is MTTR?
    a) Mean Time to Respond b) Mean Time to Detect c) Mean Time to Attack d) None
    Answer: a
15. Why is the SOC important?
    a) It protects organizations from cyber threats b) It is not important c) It only monitors threats d) None
    Answer: a

Matching Exercises

Match the term on the left with its description on the right.

Term	Description
1. SOC	A. People, Process, Technology
2. PPT	B. Security Operations Centre
3. MTTD	C. Mean Time to Detect
4. MTTR	D. Mean Time to Respond
5. KPI	E. Key Performance Indicator

Answers: 1-B, 2-A, 3-C, 4-D, 5-E

Short Answer Questions

1. What is the difference between internal and outsourced SOC?
2. What is the difference between Level 1 and Level 5 SOC maturity?
3. What are the key components of the PPT framework?
4. What are the challenges faced by SOCs?
5. What are the best practices for SOC operations?

Scenario-Based Exercises

1. Scenario: You are a SOC manager. Your team is experiencing alert fatigue. How would you address this?
2. Scenario: Your organization is building a new SOC. What factors would you consider?
3. Scenario: Your SOC is not meeting its KPIs. How would you improve performance?

Group Activity

In groups of 3-4, research a real-world SOC. Present your findings to the class, including the SOC's structure, processes, and technologies.

Individual Activity

Write a one-page report on the importance of SOC operations for an organization.

Classroom Discussion Questions

1. Why is the SOC important for organizations?
2. What are the challenges of building a SOC?
3. How can organizations measure SOC performance?
4. What is the role of automation in SOC operations?
5. How can SOCs evolve to meet new threats?

Mini Project

Project: "SOC Design." Design a SOC for a fictional organization. Include the SOC type, structure, processes, and technologies. Present your design to the class.

Practical Assignment

Research a real-world SOC. Write a one-page summary of its structure, processes, and technologies.

Challenge Exercise

Research the NIST Cybersecurity Framework. Write a one-page summary of how it can be applied to a SOC.

Quiz Answers

Fill-in-the-Blank Answers:

1. SOC
2. continuous improvement
3. recovery
4. Technology
5. federated
6. optimized
7. Performance
8. Mean
9. Mean
10. staying updated

True or False Answers: 1-T, 2-F, 3-T, 4-F, 5-F, 6-T, 7-F, 8-T, 9-T, 10-F

Key Takeaways

• A SOC is the heart of cybersecurity defence.
• SOC principles include proactive defence, continuous monitoring, rapid response, collaboration, and continuous improvement.
• SOC capabilities include monitoring, detection, investigation, response, and recovery.
• The PPT framework consists of People, Process, and Technology.
• SOC maturity evolves from reactive to proactive and optimized.
• KPIs measure SOC performance.

Preparation for the Next Module

In Module Two, you will learn about Cyber Threats, IoCs, and Attack Methodology. You will explore threat actors, attack vectors, and the Cyber Kill Chain.

---

MODULE 2

Cyber Threats, IoCs, and Attack Methodology

Module Introduction

Welcome to Module Two of your Certified Security Operations Centre Analyst Level 2 course! In this module, we will explore cyber threats, Indicators of Compromise (IoCs), and attack methodology. You will learn how to identify, classify, and respond to various types of cyber threats.

Think of this module as understanding the enemy. By the end of this module, you will be able to identify threats, understand attack patterns, and use IoCs to detect and respond to incidents.

Learning Objectives

By the end of this module, you will be able to:

• Identify different types of cyber threats.
• Understand network, host, application, and social engineering TTPs.
• Recognize email and insider attack methodologies.
• Identify Indicators of Compromise (IoCs) for various attacks.
• Apply attack frameworks (Cyber Kill Chain, MITRE ATT&CK).
• Understand advanced adversary tactics and behaviours.

---

Warm‑up Story

Chidi's Threat Investigation

Chidi was a Tier 2 SOC analyst at a bank in Lagos. He received an alert about unusual network traffic. He started investigating and identified a potential ransomware attack.

He used the Cyber Kill Chain to map the attack stages. He identified the Indicators of Compromise (IoCs) and shared them with the team. He also used MITRE ATT&CK to understand the adversary's tactics and techniques.

His investigation helped the team contain the attack and prevent further damage. Chidi learned that understanding threats and IoCs is essential for effective incident response.

Main Lessons

Lesson 1: What is a Cyber Threat?

Definition: A cyber threat is any potential danger to an organization's information systems, networks, or data.

Why it is important: Understanding threats is the first step in protecting an organization.

• Real‑life example: A phishing attack targeting employees.
• School example: A student sharing a computer with malware.
• Home example: A family member clicking on a suspicious link.
• Nigerian example: A telecom network being targeted by hackers.

Lesson 2: Types of Cyber Threats

Definition: Cyber threats can be classified into different categories.

Lesson 3: Network Threats

Definition: Network threats are attacks on network infrastructure, such as routers, switches, and firewalls.

• Examples:
  • Denial of Service (DoS): Overwhelming a network with traffic.
  • Man-in-the-Middle (MitM): Intercepting communications.
  • Network Sniffing: Capturing network traffic.
  • DNS Spoofing: Redirecting traffic to malicious sites.

Lesson 4: Host Threats

Definition: Host threats are attacks on individual systems, such as desktops, servers, and laptops.

• Examples:
  • Malware: Viruses, ransomware, spyware.
  • Unauthorized Access: Gaining access to a system without permission.
  • Privilege Escalation: Gaining higher-level access.
  • Data Theft: Stealing sensitive data.

Lesson 5: Application Threats

Definition: Application threats are attacks on software applications, such as web applications and databases.

• Examples:
  • SQL Injection: Injecting malicious SQL code.
  • Cross-Site Scripting (XSS): Injecting malicious scripts.
  • Cross-Site Request Forgery (CSRF): Forcing users to perform actions.
  • Buffer Overflow: Exploiting memory vulnerabilities.

Lesson 6: Social Engineering

Definition: Social engineering is the use of deception to manipulate people into divulging information or performing actions.

• Examples:
  • Phishing: Deceptive emails to trick users.
  • Pretexting: Creating a false scenario to obtain information.
  • Baiting: Offering something enticing to trick users.
  • Tailgating: Following someone into a secure area.

Lesson 7: Email Threats

Definition: Email threats are attacks delivered via email.

• Examples:
  • Phishing: Deceptive emails to trick users.
  • Spear Phishing: Targeted phishing attacks.
  • Whaling: Phishing targeting senior executives.
  • Business Email Compromise (BEC): Compromising business email accounts.

Lesson 8: Insider Threats

Definition: Insider threats are attacks from within the organization, such as employees or contractors.

• Types:
  • Malicious Insider: Intentionally causing harm.
  • Negligent Insider: Accidentally causing harm.
  • Compromised Insider: An insider whose account is compromised.

Lesson 9: Indicators of Compromise (IoCs)

Definition: Indicators of Compromise (IoCs) are pieces of evidence that suggest a system has been compromised.

• Examples:
  • File Hashes: MD5, SHA-1, SHA-256.
  • IP Addresses: Malicious IP addresses.
  • Domain Names: Malicious domains.
  • URLs: Malicious URLs.
  • Email Addresses: Malicious email addresses.
  • Registry Keys: Malicious registry entries.

Lesson 10: Attack Methodology – Cyber Kill Chain

Definition: The Cyber Kill Chain is a model that describes the stages of a cyber attack.

• Stages:
  • Reconnaissance: Gathering information.
  • Weaponization: Creating a weapon.
  • Delivery: Delivering the weapon.
  • Exploitation: Exploiting a vulnerability.
  • Installation: Installing malware.
  • Command and Control: Establishing control.
  • Actions on Objectives: Achieving goals.

Lesson 11: Attack Methodology – MITRE ATT&CK

Definition: MITRE ATT&CK is a knowledge base of adversary tactics and techniques.

• Tactics: The adversary's goals.
• Techniques: How the adversary achieves their goals.
• Examples:
  • Initial Access: Phishing, exploit public-facing application.
  • Execution: PowerShell, command-line interface.
  • Persistence: Registry run keys, scheduled tasks.

Lesson 12: Advanced Adversary Tactics

Definition: Advanced adversaries use sophisticated tactics to evade detection.

• Examples:
  • Living off the Land: Using legitimate tools.
  • Fileless Malware: Malware that runs in memory.
  • Polymorphic Malware: Malware that changes its code.
  • Advanced Persistent Threats (APTs): Long-term, targeted attacks.

Key Vocabulary

Important Concepts

• Cyber threats include network, host, application, social engineering, email, and insider threats.
• IoCs are evidence of compromise.
• The Cyber Kill Chain describes the stages of an attack.
• MITRE ATT&CK provides a common language for describing adversary tactics and techniques.
• Advanced adversaries use sophisticated tactics like living off the land and fileless malware.

Step-by-Step Explanations

How to Identify IoCs

1. Collect data from logs, network traffic, and endpoints.
2. Look for indicators like suspicious IP addresses, domain names, and file hashes.
3. Compare indicators against threat intelligence feeds.
4. Validate indicators to confirm they are malicious.
5. Share indicators with the team.

How to Use the Cyber Kill Chain

1. Identify the attack stage (Reconnaissance, Weaponization, etc.).
2. Map the attacker's actions to the appropriate stage.
3. Use the mapping to guide investigation and response.
4. Identify gaps in detection.
5. Improve detection based on the mapping.

Real-Life Examples

• In a business: A company uses IoCs to detect a phishing attack.
• In a school: A school uses the Cyber Kill Chain to investigate a breach.
• In a hospital: A hospital uses MITRE ATT&CK to improve threat detection.
• In Nigeria: A bank uses IoCs to detect fraud.

Nigerian Examples

• A bank in Lagos uses IoCs to detect phishing attacks.
• A telecom company in Abuja uses the Cyber Kill Chain.
• A hospital in Kano uses MITRE ATT&CK for threat detection.
• A government agency in Enugu uses IoCs for cybersecurity.

Fun Examples Children Can Relate To

• A detective looking for clues (IoCs).
• A spy following a plan (Cyber Kill Chain).
• A puzzle with pieces (MITRE ATT&CK).
• A thief using disguises (advanced tactics).

Everyday Examples

• Checking for suspicious emails (IoCs).
• Following a recipe (Cyber Kill Chain).
• Using a map (MITRE ATT&CK).
• A burglar using tools (advanced tactics).

Teacher Notes

• Emphasize the importance of understanding threats and IoCs.
• Use real-world examples to illustrate concepts.
• Discuss the role of the Cyber Kill Chain and MITRE ATT&CK.
• Encourage students to practice identifying IoCs.

Parent Tips

• Help your child understand the importance of cybersecurity.
• Discuss how to identify and avoid threats.
• Encourage them to think about IoCs and attack patterns.
• Support their interest in cybersecurity careers.

Interesting Facts

• The Cyber Kill Chain was developed by Lockheed Martin.
• MITRE ATT&CK was first released in 2013.
• IoCs are used by many security tools to detect threats.
• Advanced adversaries often use living off the land techniques.

Did You Know?

Remember This

• Cyber threats include network, host, application, social engineering, email, and insider threats.
• IoCs are evidence of compromise.
• The Cyber Kill Chain describes the stages of an attack.
• MITRE ATT&CK provides a common language for describing adversary tactics and techniques.
• Advanced adversaries use sophisticated tactics like living off the land and fileless malware.

Common Mistakes

• Ignoring IoCs: IoCs are critical for detection.
• Not using attack frameworks: Frameworks like Cyber Kill Chain and MITRE ATT&CK are essential.
• Underestimating insider threats: Insiders can cause significant damage.
• Not updating threat intelligence: Threats evolve constantly.
• Ignoring advanced tactics: Advanced adversaries use sophisticated methods.

Best Practices

• Identify and track IoCs.
• Use the Cyber Kill Chain and MITRE ATT&CK.
• Monitor for insider threats.
• Update threat intelligence regularly.
• Stay aware of advanced adversary tactics.

Comparison: Cyber Kill Chain vs MITRE ATT&CK

Feature	Cyber Kill Chain	MITRE ATT&CK
Focus	Stages of an attack	Tactics and techniques
Structure	7 stages	Matrix of tactics and techniques
Best for	Understanding attack progression	Threat detection and analysis

Comparison: Threat Types

Type	Description	Examples
Network	Attacks on infrastructure	DoS, MitM
Host	Attacks on individual systems	Malware, unauthorized access
Application	Attacks on software	SQL injection, XSS
Social Engineering	Manipulating people	Phishing, pretexting
Email	Attacks via email	Phishing, BEC
Insider	Attacks from within	Malicious, negligent

End-of-Module Summary

Congratulations! You have completed Module Two. You now know:

• The different types of cyber threats.
• Network, host, application, social engineering, email, and insider threats.
• Indicators of Compromise (IoCs).
• The Cyber Kill Chain and MITRE ATT&CK frameworks.
• Advanced adversary tactics and behaviours.

You are now ready to move on to Module Three, where you will learn about Advanced Log Management and Analysis.

Frequently Asked Questions

1. What is a cyber threat? A potential danger to information systems.
2. What are the types of cyber threats? Network, host, application, social engineering, email, and insider.
3. What is an IoC? An Indicator of Compromise.
4. What is the Cyber Kill Chain? A model describing the stages of an attack.
5. What is MITRE ATT&CK? A knowledge base of adversary tactics and techniques.
6. What is a network threat? An attack on network infrastructure.
7. What is a host threat? An attack on individual systems.
8. What is social engineering? Manipulating people to divulge information.
9. What is an insider threat? An attack from within the organization.
10. What are advanced adversary tactics? Living off the land, fileless malware, polymorphic malware, and APTs.

Review Questions

1. What is a cyber threat?
2. What are the types of cyber threats?
3. What is an IoC?
4. What is the Cyber Kill Chain?
5. What is MITRE ATT&CK?
6. What is a network threat?
7. What is a host threat?
8. What is social engineering?
9. What is an insider threat?
10. What are advanced adversary tactics?
11. What is the difference between the Cyber Kill Chain and MITRE ATT&CK?
12. What are examples of IoCs?
13. What are examples of advanced adversary tactics?
14. What is the difference between phishing and spear phishing?
15. What is the difference between a malicious and negligent insider?

Fill-in-the-Blank Exercises

1. A __________ is a potential danger to information systems.
2. __________ threats target network infrastructure.
3. __________ threats target individual systems.
4. __________ threats target software applications.
5. __________ engineering manipulates people to divulge information.
6. __________ threats are delivered via email.
7. __________ threats come from within the organization.
8. An __________ is an Indicator of Compromise.
9. The __________ Chain describes the stages of an attack.
10. __________ is a knowledge base of adversary tactics and techniques.

True or False

1. A cyber threat is a potential danger to information systems. (True)
2. Network threats target individual systems. (False)
3. Host threats target network infrastructure. (False)
4. Application threats target software applications. (True)
5. Social engineering uses deception. (True)
6. Email threats are delivered via email. (True)
7. Insider threats come from outside the organization. (False)
8. IoCs are evidence of compromise. (True)
9. The Cyber Kill Chain has 5 stages. (False)
10. MITRE ATT&CK is a knowledge base of adversary tactics and techniques. (True)

Multiple Choice Questions

1. What is a cyber threat?
   a) A potential danger b) A type of software c) A hardware device d) A threat actor
   Answer: a
2. What type of threat targets network infrastructure?
   a) Network b) Host c) Application d) Social engineering
   Answer: a
3. What type of threat targets individual systems?
   a) Host b) Network c) Application d) Social engineering
   Answer: a
4. What type of threat targets software applications?
   a) Application b) Network c) Host d) Social engineering
   Answer: a
5. What type of threat uses deception to manipulate people?
   a) Social engineering b) Network c) Host d) Application
   Answer: a
6. What type of threat is delivered via email?
   a) Email b) Network c) Host d) Application
   Answer: a
7. What type of threat comes from within the organization?
   a) Insider b) Network c) Host d) Application
   Answer: a
8. What is an IoC?
   a) An Indicator of Compromise b) A type of software c) A hardware device d) A threat actor
   Answer: a
9. What is the Cyber Kill Chain?
   a) A model describing the stages of an attack b) A type of software c) A hardware device d) A threat actor
   Answer: a
10. What is MITRE ATT&CK?
    a) A knowledge base of adversary tactics and techniques b) A type of software c) A hardware device d) A threat actor
    Answer: a
11. What is the difference between the Cyber Kill Chain and MITRE ATT&CK?
    a) Cyber Kill Chain focuses on stages; MITRE ATT&CK focuses on tactics and techniques b) They are the same c) MITRE ATT&CK focuses on stages; Cyber Kill Chain focuses on tactics and techniques d) None
    Answer: a
12. What are examples of IoCs?
    a) File hashes, IP addresses, domain names b) Only file hashes c) Only IP addresses d) None
    Answer: a
13. What are examples of advanced adversary tactics?
    a) Living off the land, fileless malware b) Only living off the land c) Only fileless malware d) None
    Answer: a
14. What is the difference between phishing and spear phishing?
    a) Spear phishing is targeted; phishing is broad b) They are the same c) Phishing is targeted; spear phishing is broad d) None
    Answer: a
15. What is the difference between a malicious and negligent insider?
    a) Malicious is intentional; negligent is accidental b) They are the same c) Negligent is intentional; malicious is accidental d) None
    Answer: a

Matching Exercises

Match the term on the left with its description on the right.

Term	Description
1. Network Threat	A. Attacks on individual systems
2. Host Threat	B. Attacks on network infrastructure
3. Application Threat	C. Attacks using deception
4. Social Engineering	D. Attacks on software applications
5. Insider Threat	E. Attacks from within the organization

Answers: 1-B, 2-A, 3-D, 4-C, 5-E

Short Answer Questions

1. What is the difference between the Cyber Kill Chain and MITRE ATT&CK?
2. What are examples of IoCs?
3. What are examples of advanced adversary tactics?
4. What is the difference between phishing and spear phishing?
5. What is the difference between a malicious and negligent insider?

Scenario-Based Exercises

1. Scenario: You are a SOC analyst. You receive an alert about a potential phishing attack. How would you investigate?
2. Scenario: You are investigating a potential insider threat. What steps would you take?
3. Scenario: You need to identify IoCs for a ransomware attack. What would you look for?

Group Activity

In groups of 3-4, research a recent cyber attack. Identify the threat type, IoCs, and map the attack to the Cyber Kill Chain. Present your findings to the class.

Individual Activity

Write a one-page report on a recent cyber threat. Include the threat type, IoCs, and attack methodology.

Classroom Discussion Questions

1. Why is it important to understand threats and IoCs?
2. How can the Cyber Kill Chain improve incident response?
3. What is the role of MITRE ATT&CK in threat detection?
4. How can organizations defend against advanced adversary tactics?
5. What are the challenges of detecting insider threats?

Mini Project

Project: "Threat Intelligence Report." Create a threat intelligence report on a recent cyber attack. Include the threat type, IoCs, attack methodology, and recommendations. Present your report to the class.

Practical Assignment

Identify IoCs for a recent cyber attack. Document your findings and create a report.

Challenge Exercise

Research a real-world APT campaign. Map the attack to the Cyber Kill Chain and MITRE ATT&CK. Write a one-page summary of your findings.

Quiz Answers

Fill-in-the-Blank Answers:

1. cyber threat
2. Network
3. Host
4. Application
5. Social
6. Email
7. Insider
8. IoC
9. Kill
10. MITRE ATT&CK

True or False Answers: 1-T, 2-F, 3-F, 4-T, 5-T, 6-T, 7-F, 8-T, 9-F, 10-T

Key Takeaways

• Cyber threats include network, host, application, social engineering, email, and insider threats.
• IoCs are evidence of compromise.
• The Cyber Kill Chain describes the stages of an attack.
• MITRE ATT&CK provides a common language for describing adversary tactics and techniques.
• Advanced adversaries use sophisticated tactics like living off the land and fileless malware.

Preparation for the Next Module

In Module Three, you will learn about Advanced Log Management and Analysis. You will explore local logging practices, centralised logging, and statistical analysis.

---

MODULE 3

Advanced Log Management and Analysis

Module Introduction

Welcome to Module Three of your Certified Security Operations Centre Analyst Level 2 course! In this module, we will explore advanced log management and analysis. You will learn how to collect, manage, and analyze logs from various sources to detect threats.

Think of this module as learning the language of your systems. Logs are the digital footprints left by users, applications, and systems. By the end of this module, you will be able to analyze logs to identify malicious activity.

Learning Objectives

By the end of this module, you will be able to:

• Understand log management importance and approaches.
• Implement local logging practices (Windows, Linux, Mac).
• Analyze firewall, router, web server, database, and email logs.
• Implement centralised logging.
• Apply statistical and behavioural anomaly detection.

---

Warm‑up Story

Kemi's Log Analysis Success

Kemi was a Tier 2 SOC analyst at a bank in Lagos. She received an alert about unusual network activity. She started analyzing logs from the firewall, web server, and database.

She identified a pattern of suspicious requests to the web server. She used statistical analysis to detect anomalies and identified a potential SQL injection attack. Her quick analysis helped the team block the attack.

Kemi learned that log analysis is essential for detecting and responding to threats. She now uses logs to investigate every incident.

Main Lessons

Lesson 1: Introduction to Log Management

Definition: Log management is the process of collecting, storing, and analyzing logs from various sources.

Why it is important: Logs provide a record of activity on systems and networks, making them essential for detecting and investigating threats.

• Real‑life example: A company collects logs from firewalls to detect intrusions.
• School example: A school collects logs from student computers.
• Home example: A family checks logs from their home router.
• Nigerian example: A bank collects logs from ATMs.

Lesson 2: Log Management Approaches

Definition: There are different approaches to log management.

• Centralized Logging: Logs are sent to a central server.
• Distributed Logging: Logs are stored locally on each system.
• Hybrid Logging: A combination of centralized and distributed.

Lesson 3: Local Logging Practices – Windows

Definition: Windows provides several logging mechanisms, including Event Logs, Sysmon, and PowerShell logs.

• Windows Event Logs: Record system, application, and security events.
• Sysmon: Provides detailed system monitoring.
• PowerShell Logs: Record PowerShell activity.

Lesson 4: Local Logging Practices – Linux

Definition: Linux provides several logging mechanisms, including syslog, rsyslog, and auditd.

• syslog: A standard for log collection.
• rsyslog: An enhanced version of syslog.
• auditd: The Linux audit system.

Lesson 5: Local Logging Practices – Mac

Definition: Mac provides logging mechanisms through the unified logging system.

• Unified Logging: macOS system logs.
• Apple System Log (ASL): Legacy logging system.
• Console App: Tool for viewing logs.

Lesson 6: Firewall Logs

Definition: Firewall logs record traffic that passes through a firewall.

• What to look for:
  • Blocked traffic: Attempts to access blocked services.
  • Allowed traffic: Unusual traffic patterns.
  • Port scanning: Multiple connection attempts.
  • Source/destination IPs: Malicious IP addresses.

Lesson 7: Router Logs

Definition: Router logs record activity on network routers.

• What to look for:
  • Routing changes: Unauthorized changes to routing tables.
  • Interface errors: Network issues.
  • Login attempts: Failed or suspicious logins.

Lesson 8: Web Server Logs

Definition: Web server logs record requests to web servers.

• What to look for:
  • 404 errors: Attempts to access non-existent pages.
  • SQL injection attempts: Suspicious SQL keywords.
  • XSS attempts: Suspicious script tags.
  • Unusual user agents: Non-standard browsers.

Lesson 9: Database Logs

Definition: Database logs record activity on databases.

• What to look for:
  • Failed login attempts: Suspicious access attempts.
  • Large queries: Unusual data requests.
  • SQL injection: Suspicious SQL commands.
  • Privilege changes: Unauthorized permission changes.

Lesson 10: Email Logs

Definition: Email logs record email traffic and activity.

• What to look for:
  • Spam: Unusual email volume.
  • Phishing: Suspicious email content.
  • Bounce errors: Failed email deliveries.
  • Login attempts: Suspicious access to email accounts.

Lesson 11: Centralised Logging

Definition: Centralised logging is the process of sending logs from multiple sources to a central server.

• Benefits:
  • Easier analysis: All logs in one place.
  • Better correlation: Identify patterns across sources.
  • Improved security: Logs are protected.
• Tools:
  • ELK Stack: Elasticsearch, Logstash, Kibana.
  • Splunk: Commercial SIEM.
  • Graylog: Open-source log management.

Lesson 12: Statistical and Behavioural Anomaly Detection

Definition: Anomaly detection identifies unusual patterns in logs.

• Statistical Anomaly Detection:
  • Baseline: Establish normal behaviour.
  • Thresholds: Set limits for normal activity.
  • Alerts: Trigger when limits are exceeded.
• Behavioural Anomaly Detection:
  • User behaviour: Identify unusual user activity.
  • System behaviour: Identify unusual system activity.
  • Network behaviour: Identify unusual network activity.

Key Vocabulary

Important Concepts

• Log management is essential for detecting and investigating threats.
• Local logging practices vary by operating system.
• Firewall, router, web server, database, and email logs provide valuable insights.
• Centralised logging simplifies analysis and correlation.
• Statistical and behavioural anomaly detection identifies unusual patterns.

Step-by-Step Explanations

How to Implement Centralised Logging

1. Choose a logging tool (ELK Stack, Splunk, Graylog).
2. Configure log sources to send logs to the central server.
3. Set up log collection and storage.
4. Create dashboards for log analysis.
5. Set up alerts for suspicious activity.

How to Detect Anomalies in Logs

1. Establish a baseline of normal activity.
2. Set thresholds for normal activity.
3. Monitor logs for deviations from the baseline.
4. Investigate anomalies.
5. Update baselines and thresholds as needed.

Real-Life Examples

• In a business: A company uses centralised logging to detect intrusions.
• In a school: A school uses logs to monitor student activity.
• In a hospital: A hospital uses logs to protect patient data.
• In Nigeria: A bank uses logs to detect fraud.

Nigerian Examples

• A bank in Lagos uses centralised logging to detect intrusions.
• A telecom company in Abuja uses logs to monitor network activity.
• A hospital in Kano uses logs to protect patient data.
• A government agency in Enugu uses logs for security monitoring.

Fun Examples Children Can Relate To

• A diary recording daily activities (logs).
• A librarian organizing books (log management).
• A detective looking for clues (log analysis).
• A weather report (anomaly detection).

Everyday Examples

• A call log on your phone (logs).
• Organizing your files (log management).
• Checking your bank statement (log analysis).
• Noticing unusual activity (anomaly detection).

Teacher Notes

• Emphasize the importance of log management.
• Use real-world examples to illustrate concepts.
• Discuss the role of centralised logging.
• Encourage students to practice log analysis.

Parent Tips

• Help your child understand the importance of logs.
• Discuss how logs can detect threats.
• Encourage them to think about log analysis.
• Support their interest in cybersecurity careers.

Interesting Facts

• Logs are often the first evidence of a security incident.
• Centralised logging was first introduced in the 1990s.
• Anomaly detection is used in many security tools.
• ELK Stack is used by many organizations for log analysis.

Did You Know?

Remember This

• Log management is essential for detecting and investigating threats.
• Local logging practices vary by operating system.
• Firewall, router, web server, database, and email logs provide valuable insights.
• Centralised logging simplifies analysis and correlation.
• Statistical and behavioural anomaly detection identifies unusual patterns.

Common Mistakes

• Not collecting enough logs: Incomplete data leads to missed threats.
• Not centralising logs: Distributed logs are harder to analyze.
• Not analyzing logs: Logs are useless without analysis.
• Ignoring anomalies: Anomalies can indicate threats.
• Not updating baselines: Baselines must be updated regularly.

Best Practices

• Collect logs from all sources.
• Centralise logs for easier analysis.
• Analyze logs regularly.
• Investigate anomalies.
• Update baselines regularly.

Comparison: Centralised vs Distributed Logging

Feature	Centralised	Distributed
Log location	Central server	Local systems
Analysis	Easier	Harder
Security	Higher	Lower
Best for	Large organizations	Small organizations

Comparison: Log Sources

Source	Description	Key Insights
Firewall	Traffic records	Blocked traffic, port scanning
Router	Network activity	Routing changes, interface errors
Web Server	Web requests	404 errors, SQL injection
Database	Database activity	Failed logins, large queries
Email	Email traffic	Spam, phishing

End-of-Module Summary

Congratulations! You have completed Module Three. You now know:

• The importance of log management.
• Local logging practices for Windows, Linux, and Mac.
• How to analyze firewall, router, web server, database, and email logs.
• How to implement centralised logging.
• How to apply statistical and behavioural anomaly detection.

You are now ready to move on to Module Four, where you will learn about Incident Detection with SIEM.

Frequently Asked Questions

1. What is log management? Collecting, storing, and analyzing logs.
2. What is centralised logging? Logs sent to a central server.
3. What is distributed logging? Logs stored locally.
4. What are Windows logs? Event Logs, Sysmon, PowerShell logs.
5. What are Linux logs? syslog, rsyslog, auditd.
6. What are Mac logs? Unified logging, ASL.
7. What are firewall logs? Traffic records.
8. What are web server logs? Web request records.
9. What are database logs? Database activity records.
10. What is anomaly detection? Identifying unusual patterns.

Review Questions

1. What is log management?
2. What is centralised logging?
3. What is distributed logging?
4. What are Windows logs?
5. What are Linux logs?
6. What are Mac logs?
7. What are firewall logs?
8. What are web server logs?
9. What are database logs?
10. What is anomaly detection?
11. What is the difference between centralised and distributed logging?
12. What is the difference between statistical and behavioural anomaly detection?
13. What are the benefits of centralised logging?
14. What are the tools for centralised logging?
15. How do you implement centralised logging?

Fill-in-the-Blank Exercises

1. __________ is the process of collecting, storing, and analyzing logs.
2. __________ logging sends logs to a central server.
3. __________ logging stores logs locally.
4. Windows logs include Event Logs, Sysmon, and __________ logs.
5. Linux logs include syslog, rsyslog, and __________.
6. Mac logs include unified logging and __________.
7. __________ logs record traffic that passes through a firewall.
8. __________ logs record requests to web servers.
9. __________ logs record activity on databases.
10. __________ detection identifies unusual patterns in logs.

True or False

1. Log management is not important. (False)
2. Centralised logging collects logs from multiple sources. (True)
3. Distributed logging stores logs on a central server. (False)
4. Windows logs include Event Logs. (True)
5. Linux logs include syslog. (True)
6. Mac logs include auditd. (False)
7. Firewall logs record traffic. (True)
8. Web server logs record database queries. (False)
9. Database logs record web requests. (False)
10. Anomaly detection identifies unusual patterns. (True)

Multiple Choice Questions

1. What is log management?
   a) Collecting, storing, and analyzing logs b) A type of software c) A hardware device d) A threat
   Answer: a
2. What is centralised logging?
   a) Logs sent to a central server b) Logs stored locally c) A type of software d) A hardware device
   Answer: a
3. What is distributed logging?
   a) Logs stored locally b) Logs sent to a central server c) A type of software d) A hardware device
   Answer: a
4. What are Windows logs?
   a) Event Logs, Sysmon, PowerShell logs b) syslog, rsyslog c) Unified logging d) None
   Answer: a
5. What are Linux logs?
   a) syslog, rsyslog, auditd b) Event Logs c) Unified logging d) None
   Answer: a
6. What are Mac logs?
   a) Unified logging, ASL b) syslog, rsyslog c) Event Logs d) None
   Answer: a
7. What are firewall logs?
   a) Traffic records b) Web request records c) Database activity records d) None
   Answer: a
8. What are web server logs?
   a) Web request records b) Traffic records c) Database activity records d) None
   Answer: a
9. What are database logs?
   a) Database activity records b) Traffic records c) Web request records d) None
   Answer: a
10. What is anomaly detection?
    a) Identifying unusual patterns b) A type of software c) A hardware device d) A threat
    Answer: a
11. What is the difference between centralised and distributed logging?
    a) Centralised sends logs to a central server; distributed stores logs locally b) They are the same c) Distributed sends logs to a central server; centralised stores logs locally d) None
    Answer: a
12. What is the difference between statistical and behavioural anomaly detection?
    a) Statistical uses baselines; behavioural uses user behaviour b) They are the same c) Behavioural uses baselines; statistical uses user behaviour d) None
    Answer: a
13. What are the benefits of centralised logging?
    a) Easier analysis, better correlation, improved security b) Only easier analysis c) Only better correlation d) None
    Answer: a
14. What are the tools for centralised logging?
    a) ELK Stack, Splunk, Graylog b) Only ELK Stack c) Only Splunk d) None
    Answer: a
15. How do you implement centralised logging?
    a) Choose a tool, configure log sources, set up collection, create dashboards, set up alerts b) Only choose a tool c) Only configure log sources d) None
    Answer: a

Matching Exercises

Match the term on the left with its description on the right.

Term	Description
1. Centralised Logging	A. Logs stored locally
2. Distributed Logging	B. Logs sent to a central server
3. syslog	C. Linux logging system
4. Sysmon	D. Windows monitoring tool
5. auditd	E. Linux audit system

Answers: 1-B, 2-A, 3-C, 4-D, 5-E

Short Answer Questions

1. What is the difference between centralised and distributed logging?
2. What is the difference between statistical and behavioural anomaly detection?
3. What are the benefits of centralised logging?
4. What are the tools for centralised logging?
5. How do you implement centralised logging?

Scenario-Based Exercises

1. Scenario: You are a SOC analyst. You need to implement centralised logging. What steps would you take?
2. Scenario: You notice unusual activity in your firewall logs. How would you investigate?
3. Scenario: You need to detect anomalies in your logs. How would you do it?

Group Activity

In groups of 3-4, set up a centralised logging environment using ELK Stack or Graylog. Collect logs from multiple sources and create dashboards. Present your setup to the class.

Individual Activity

Write a one-page report on a log analysis tool of your choice (ELK Stack, Splunk, or Graylog). Include its features and use cases.

Classroom Discussion Questions

1. Why is log management important for SOCs?
2. What are the challenges of log management?
3. How can centralised logging improve security?
4. What is the role of anomaly detection in log analysis?
5. How can organizations improve their log management practices?

Mini Project

Project: "Log Management Implementation." Implement a centralised logging solution for a fictional organization. Include log collection, analysis, and dashboards. Present your solution to the class.

Practical Assignment

Set up a centralised logging environment using ELK Stack or Graylog. Collect logs from at least two sources. Create a dashboard to visualize the logs.

Challenge Exercise

Research the differences between ELK Stack and Splunk. Write a one-page summary of the differences and which is better for specific use cases.

Quiz Answers

Fill-in-the-Blank Answers:

1. Log management
2. Centralised
3. Distributed
4. PowerShell
5. auditd
6. ASL
7. Firewall
8. Web server
9. Database
10. Anomaly

True or False Answers: 1-F, 2-T, 3-F, 4-T, 5-T, 6-F, 7-T, 8-F, 9-F, 10-T

Key Takeaways

• Log management is essential for detecting and investigating threats.
• Local logging practices vary by operating system.
• Firewall, router, web server, database, and email logs provide valuable insights.
• Centralised logging simplifies analysis and correlation.
• Statistical and behavioural anomaly detection identifies unusual patterns.

Preparation for the Next Module

In Module Four, you will learn about Incident Detection with SIEM. You will explore SIEM architecture, deployment, and use case management.

---

MODULE 4

Incident Detection with SIEM

Module Introduction

Welcome to Module Four of your Certified Security Operations Centre Analyst Level 2 course! In this module, we will explore incident detection with SIEM. You will learn how to deploy and use SIEM (Security Information and Event Management) systems to detect and respond to threats.

Think of SIEM as the brain of the SOC. It collects, analyzes, and correlates logs from various sources to identify threats. By the end of this module, you will be able to configure and use SIEM for incident detection.

Learning Objectives

By the end of this module, you will be able to:

• Understand SIEM architecture and importance.
• Evaluate SIEM solutions and their advantages/disadvantages.
• Deploy SIEM and manage use cases.
• Detect incidents using SIEM.
• Apply AI for generating SIEM rules.
• Perform alert triaging, correlation, and multi-domain event detection.
• Create visualizations, dashboards, and SOC reports.

---

Warm‑up Story

Amara's SIEM Success

Amara was a Tier 2 SOC analyst at a bank in Lagos. She was tasked with deploying a SIEM solution to improve threat detection. She evaluated several SIEM solutions and chose an open-source option.

She deployed the SIEM and configured use cases for detecting threats. She used AI to generate SIEM rules and set up alert triaging. She created dashboards to visualize security events.

Within a few weeks, the SIEM detected a potential ransomware attack. Amara's quick response prevented the attack from spreading. She learned that SIEM is essential for effective incident detection.

Main Lessons

Lesson 1: SIEM Architecture

Definition: SIEM (Security Information and Event Management) is a system that collects, analyzes, and correlates logs from various sources to detect threats.

Why it is important: SIEM provides a centralized view of security events, enabling faster detection and response.

• Key components:
  • Data Sources: Firewalls, IDS/IPS, EDR, Windows logs, Linux logs.
  • Log Collection: Agents or syslog collect logs.
  • Normalization: Converts logs into a standard format.
  • Storage: Stores logs for analysis.
  • Analysis: Correlates events and detects threats.
  • Dashboards: Visualizes security data.
  • Alerting: Generates alerts for suspicious activity.

Lesson 2: SIEM Solutions

Definition: SIEM solutions are software platforms that provide SIEM capabilities.

• Advantages:
  • Centralized monitoring: Single view of security events.
  • Correlation: Identify patterns across logs.
  • Alerting: Generate alerts for threats.
• Disadvantages:
  • Complexity: SIEM can be complex to deploy and manage.
  • Cost: Commercial SIEM solutions can be expensive.
  • Alert fatigue: Too many alerts can overwhelm analysts.

Lesson 3: SIEM Deployment

Definition: SIEM deployment is the process of implementing a SIEM solution.

• Steps:
  • Plan: Define requirements and goals.
  • Choose a solution: Select a SIEM tool.
  • Deploy: Install and configure the SIEM.
  • Integrate: Connect data sources.
  • Configure: Set up use cases and rules.
  • Test: Validate the deployment.
  • Monitor: Continuously monitor and improve.

Lesson 4: Use Case Management

Definition: Use case management is the process of defining and managing SIEM use cases.

• Examples:
  • Brute force attack: Multiple failed login attempts.
  • Malware detection: Identify malware-related events.
  • Insider threat: Unusual user behavior.
• Steps:
  • Define: Identify the use case.
  • Configure: Set up rules and alerts.
  • Test: Validate the use case.
  • Deploy: Implement the use case.
  • Monitor: Continuously monitor and improve.

Lesson 5: Incident Detection with SIEM

Definition: Incident detection with SIEM involves using SIEM to identify and respond to security incidents.

• Steps:
  • Collect logs: Gather logs from data sources.
  • Normalize: Convert logs to a standard format.
  • Correlate: Identify patterns and relationships.
  • Alert: Generate alerts for suspicious activity.
  • Investigate: Analyze alerts to determine if they are threats.
  • Respond: Take action to mitigate threats.

Lesson 6: AI for Generating SIEM Rules

Definition: AI can be used to generate SIEM rules automatically.

• Benefits:
  • Automation: Reduces manual effort.
  • Accuracy: Improves detection accuracy.
  • Adaptability: Adapts to new threats.
• Methods:
  • Machine learning: Train models on historical data.
  • Behavioral analysis: Identify anomalies.
  • Threat intelligence: Incorporate threat data.

Lesson 7: Alert Triaging

Definition: Alert triaging is the process of prioritizing alerts based on severity.

• Steps:
  • Severity: Determine the severity of the alert.
  • Impact: Assess the impact on the organization.
  • Urgency: Determine how quickly it needs to be addressed.
  • Prioritize: Focus on the most critical alerts first.

Lesson 8: Correlation and Multi-Domain Event Detection

Definition: Correlation identifies patterns across multiple events. Multi-domain event detection analyzes events across different domains.

• Correlation:
  • Rules: Define correlation rules.
  • Patterns: Identify patterns in events.
  • Alerts: Generate alerts for correlated events.
• Multi-Domain Detection:
  • Network: Analyze network events.
  • Host: Analyze host events.
  • Application: Analyze application events.
  • User: Analyze user activity.

Lesson 9: Visualization, Dashboard Management, and SOC Reports

Definition: Visualization and dashboards provide a visual representation of security data. SOC reports summarize security events and incidents.

• Visualization:
  • Charts: Bar charts, pie charts, line graphs.
  • Maps: Geographic visualizations.
  • Heat maps: Show activity patterns.
• Dashboards:
  • Real-time: Monitor events in real-time.
  • Historical: Analyze historical data.
  • Custom: Tailor dashboards to specific needs.
• SOC Reports:
  • Daily: Summary of daily events.
  • Weekly: Trend analysis.
  • Monthly: Performance review.

Lesson 10: SIEM Best Practices

Definition: Best practices for effective SIEM implementation.

• Collect logs from all sources: Ensure comprehensive coverage.
• Normalize logs: Standardize log formats.
• Create effective rules: Detect threats accurately.
• Fine-tune rules: Minimize false positives.
• Create dashboards: Visualize security data.
• Monitor and update: Continuously improve.

Key Vocabulary

Important Concepts

• SIEM is the brain of the SOC.
• SIEM architecture includes data sources, log collection, normalization, storage, analysis, dashboards, and alerting.
• SIEM solutions have advantages and disadvantages.
• Use case management defines and manages SIEM use cases.
• AI can automate SIEM rule generation.
• Alert triaging prioritizes alerts.
• Visualization and dashboards provide a visual representation of security data.

Step-by-Step Explanations

How to Deploy SIEM

1. Plan the deployment.
2. Choose a SIEM solution.
3. Install and configure the SIEM.
4. Integrate data sources.
5. Configure use cases and rules.
6. Test the deployment.
7. Monitor and improve.

How to Create SIEM Dashboards

1. Identify the data you want to visualize.
2. Create visualizations (charts, tables, graphs).
3. Add visualizations to dashboards.
4. Customize dashboards for specific needs.
5. Monitor dashboards in real-time.

Real-Life Examples

• In a business: A company uses SIEM to detect intrusions.
• In a school: A school uses SIEM to protect student data.
• In a hospital: A hospital uses SIEM to protect patient data.
• In Nigeria: A bank uses SIEM to detect fraud.

Nigerian Examples

• A bank in Lagos uses SIEM to detect fraud.
• A telecom company in Abuja uses SIEM for threat detection.
• A hospital in Kano uses SIEM to protect patient data.
• A government agency in Enugu uses SIEM for security monitoring.

Fun Examples Children Can Relate To

• A security guard watching cameras (SIEM monitoring).
• A detective connecting clues (correlation).
• A scoreboard showing game statistics (dashboard).
• A fire alarm alerting you to danger (alerting).

Everyday Examples

• A security camera system monitoring your home (SIEM).
• A dashboard showing your daily activities (visualization).
• A smoke detector alerting you to a fire (alerting).
• A log of your phone calls (log collection).

Teacher Notes

• Emphasize the importance of SIEM in SOC operations.
• Use real-world examples to illustrate concepts.
• Discuss the role of AI in SIEM.
• Encourage students to practice with SIEM tools.

Parent Tips

• Help your child understand the importance of SIEM.
• Discuss how SIEM tools detect threats.
• Encourage them to think about SIEM in cybersecurity.
• Support their interest in cybersecurity careers.

Interesting Facts

• SIEM was first introduced in the 2000s.
• AI is increasingly used in SIEM.
• SIEM can process millions of events per second.
• Many SIEM solutions are cloud-based.

Did You Know?

Remember This

• SIEM is the brain of the SOC.
• SIEM architecture includes data sources, log collection, normalization, storage, analysis, dashboards, and alerting.
• SIEM solutions have advantages and disadvantages.
• Use case management defines and manages SIEM use cases.
• AI can automate SIEM rule generation.
• Alert triaging prioritizes alerts.
• Visualization and dashboards provide a visual representation of security data.

Common Mistakes

• Not collecting enough logs: Incomplete data leads to missed threats.
• Not normalizing logs: Inconsistent formats hinder analysis.
• Creating too many alerts: Alert fatigue leads to ignored alerts.
• Not fine-tuning rules: Rules must be adjusted to reduce false positives.
• Not creating dashboards: Visualizations help analysts identify threats.

Best Practices

• Collect logs from all sources.
• Normalize log formats.
• Create effective rules and fine-tune them.
• Create dashboards for real-time monitoring.
• Monitor and update SIEM regularly.

Comparison: SIEM Solutions

Feature	Commercial SIEM	Open-Source SIEM
Cost	High	Low
Support	Vendor-provided	Community-driven
Features	Advanced	Basic
Best for	Large enterprises	Small-to-medium businesses

Comparison: SIEM Components

Component	Purpose
Log Collection	Gather logs from sources
Normalization	Standardize log formats
Storage	Store logs for analysis
Analysis	Correlate events
Dashboards	Visualize security data
Alerting	Generate alerts for threats

End-of-Module Summary

Congratulations! You have completed Module Four. You now know:

• SIEM architecture and importance.
• SIEM solutions and their advantages/disadvantages.
• SIEM deployment and use case management.
• Incident detection with SIEM.
• AI for generating SIEM rules.
• Alert triaging, correlation, and multi-domain event detection.
• Visualization, dashboard management, and SOC reports.
• Best practices for SIEM.

You are now ready to move on to Module Five, where you will learn about Proactive Threat Detection and Threat Hunting.

Frequently Asked Questions

1. What is SIEM? Security Information and Event Management.
2. What is normalization? Converting logs into a standard format.
3. What is correlation? Identifying patterns across events.
4. What is a use case? A specific scenario for detecting threats.
5. What is alert triage? Prioritizing alerts.
6. What is a dashboard? A visual display of security data.
7. What is multi-domain detection? Analyzing events across domains.
8. What are AI rules? Rules generated by AI.
9. What is a SOC report? A summary of security events.
10. What is alert fatigue? Too many alerts leading to missed threats.

Review Questions

1. What is SIEM?
2. What are the components of SIEM?
3. What are the advantages of SIEM?
4. What are the disadvantages of SIEM?
5. What is use case management?
6. What is incident detection with SIEM?
7. How does AI help with SIEM?
8. What is alert triaging?
9. What is correlation?
10. What is multi-domain event detection?
11. What is a dashboard?
12. What is a SOC report?
13. What are the best practices for SIEM?
14. How do you deploy SIEM?
15. How do you create SIEM dashboards?

Fill-in-the-Blank Exercises

1. __________ is Security Information and Event Management.
2. __________ converts logs into a standard format.
3. __________ identifies patterns across events.
4. A __________ is a specific scenario for detecting threats.
5. __________ prioritizes alerts.
6. A __________ is a visual display of security data.
7. __________ analyzes events across domains.
8. __________ are rules generated by AI.
9. A __________ is a summary of security events.
10. __________ is too many alerts leading to missed threats.

True or False

1. SIEM is the brain of the SOC. (True)
2. Normalization converts logs into a standard format. (True)
3. Correlation identifies patterns across events. (True)
4. Use case management is not important. (False)
5. Alert triaging prioritizes alerts. (True)
6. Dashboards are not useful for SIEM. (False)
7. Multi-domain detection analyzes events across domains. (True)
8. AI cannot generate SIEM rules. (False)
9. SOC reports are not needed. (False)
10. Alert fatigue leads to missed threats. (True)

Multiple Choice Questions

1. What is SIEM?
   a) Security Information and Event Management b) A type of software c) A hardware device d) A threat
   Answer: a
2. What is normalization?
   a) Converting logs into a standard format b) Identifying patterns c) Generating alerts d) None
   Answer: a
3. What is correlation?
   a) Identifying patterns across events b) Converting logs c) Generating alerts d) None
   Answer: a
4. What is a use case?
   a) A specific scenario for detecting threats b) A type of software c) A hardware device d) None
   Answer: a
5. What is alert triage?
   a) Prioritizing alerts b) Generating alerts c) Converting logs d) None
   Answer: a
6. What is a dashboard?
   a) A visual display of security data b) A type of software c) A hardware device d) None
   Answer: a
7. What is multi-domain detection?
   a) Analyzing events across domains b) Generating alerts c) Converting logs d) None
   Answer: a
8. What are AI rules?
   a) Rules generated by AI b) A type of software c) A hardware device d) None
   Answer: a
9. What is a SOC report?
   a) A summary of security events b) A type of software c) A hardware device d) None
   Answer: a
10. What is alert fatigue?
    a) Too many alerts leading to missed threats b) Generating alerts c) Converting logs d) None
    Answer: a
11. What is the difference between commercial and open-source SIEM?
    a) Commercial is expensive; open-source is free b) They are the same c) Open-source is expensive; commercial is free d) None
    Answer: a
12. What are the components of SIEM?
    a) Data sources, log collection, normalization, storage, analysis, dashboards, alerting b) Only data sources c) Only dashboards d) None
    Answer: a
13. What is a best practice for SIEM?
    a) Collect logs from all sources b) Ignore logs c) Use one data source d) None
    Answer: a
14. How do you deploy SIEM?
    a) Plan, choose a solution, deploy, integrate, configure, test, monitor b) Only plan c) Only choose a solution d) None
    Answer: a
15. How do you create SIEM dashboards?
    a) Identify data, create visualizations, add to dashboards, customize, monitor b) Only identify data c) Only create visualizations d) None
    Answer: a

Matching Exercises

Match the term on the left with its description on the right.

Term	Description
1. SIEM	A. A specific scenario for detecting threats
2. Normalization	B. Security Information and Event Management
3. Use Case	C. Converting logs into a standard format
4. Dashboard	D. A visual display of security data
5. Alert Triage	E. Prioritizing alerts

Answers: 1-B, 2-C, 3-A, 4-D, 5-E

Short Answer Questions

1. What are the components of SIEM?
2. What is the difference between commercial and open-source SIEM?
3. What is use case management?
4. How does AI help with SIEM?
5. What are the best practices for SIEM?

Scenario-Based Exercises

1. Scenario: You are a SOC analyst. You need to deploy a SIEM solution. What steps would you take?
2. Scenario: You are using SIEM and notice many alerts. How would you triage them?
3. Scenario: You need to create a SOC report. What would you include?

Group Activity

In groups of 3-4, deploy a SIEM solution (ELK Stack, Splunk, or Wazuh). Create dashboards and rules to detect threats. Present your setup to the class.

Individual Activity

Write a one-page report on a SIEM tool of your choice (ELK Stack, Splunk, or Wazuh). Include its features and use cases.

Classroom Discussion Questions

1. Why is SIEM important for SOCs?
2. What are the challenges of SIEM implementation?
3. How can organizations reduce alert fatigue?
4. What is the role of AI in SIEM?
5. How can dashboards improve incident detection?

Mini Project

Project: "SIEM Implementation." Implement a SIEM solution for a fictional organization. Include log collection, use cases, dashboards, and alerts. Present your solution to the class.

Practical Assignment

Set up a SIEM environment using ELK Stack or Wazuh. Collect logs from at least two sources. Create dashboards and rules to detect threats.

Challenge Exercise

Research the differences between ELK Stack and Splunk. Write a one-page summary of the differences and which is better for specific use cases.

Quiz Answers

Fill-in-the-Blank Answers:

1. SIEM
2. Normalization
3. Correlation
4. use case
5. Alert triage
6. dashboard
7. Multi-domain detection
8. AI rules
9. SOC report
10. Alert fatigue

True or False Answers: 1-T, 2-T, 3-T, 4-F, 5-T, 6-F, 7-T, 8-F, 9-F, 10-T

Key Takeaways

• SIEM is the brain of the SOC.
• SIEM architecture includes data sources, log collection, normalization, storage, analysis, dashboards, and alerting.
• SIEM solutions have advantages and disadvantages.
• Use case management defines and manages SIEM use cases.
• AI can automate SIEM rule generation.
• Alert triaging prioritizes alerts.
• Visualization and dashboards provide a visual representation of security data.

Preparation for the Next Module

In Module Five, you will learn about Proactive Threat Detection and Threat Hunting. You will explore threat intelligence, threat hunting methodologies, and tools.

---

MODULE 5

Proactive Threat Detection and Threat Hunting

Module Introduction

Welcome to Module Five of your Certified Security Operations Centre Analyst Level 2 course! In this module, we will explore proactive threat detection and threat hunting. You will learn how to stay ahead of attackers by proactively hunting for threats.

Think of threat hunting as cybersecurity detective work. Instead of waiting for alerts, hunters actively search for signs of compromise. By the end of this module, you will be able to conduct threat hunts using various tools and frameworks.

Learning Objectives

By the end of this module, you will be able to:

• Understand threat intelligence fundamentals.
• Identify threat intelligence sources and platforms.
• Apply threat intelligence in SOC operations.
• Understand threat hunting significance and frameworks.
• Use PowerShell, YARA, and other tools for threat hunting.
• Apply structured and unstructured threat hunting.
• Use data transformation techniques.

---

Warm‑up Story

Chuka's Threat Hunting Discovery

Chuka was a Tier 2 SOC analyst at a bank in Lagos. He noticed that traditional alerting was not catching all threats. He decided to start threat hunting.

He used threat intelligence to guide his hunts. He used PowerShell to search for suspicious activity on endpoints. He used YARA rules to identify malware. His proactive hunting uncovered a persistent threat that had evaded detection.

Chuka's efforts prevented a major data breach. He learned that threat hunting is essential for staying ahead of attackers.

Main Lessons

Lesson 1: Threat Intelligence Fundamentals

Definition: Threat intelligence is information about threats that helps organizations defend against them.

Why it is important: Threat intelligence provides context about threats, enabling proactive defense.

• Real‑life example: A company uses threat intelligence to identify new ransomware variants.
• School example: A school uses threat intelligence to protect student data.
• Home example: A family uses threat intelligence to avoid phishing scams.
• Nigerian example: A bank uses threat intelligence to detect fraud.

Lesson 2: Types of Threat Intelligence

Definition: Threat intelligence can be categorized into different types.

• Strategic: High-level insights for decision-makers.
• Tactical: Information about attacker tactics, techniques, and procedures (TTPs).
• Operational: Specific threat information.
• Technical: Indicators of compromise (IoCs).

Lesson 3: Threat Intelligence Sources

Definition: Threat intelligence sources are places where threat intelligence is obtained.

• Open-source intelligence (OSINT): Publicly available information.
• Commercial intelligence: Paid threat intelligence feeds.
• Information sharing: Sharing intelligence with other organizations.
• Government sources: Intelligence from government agencies.

Lesson 4: Threat Intelligence Platforms (TIP)

Definition: A Threat Intelligence Platform (TIP) is a tool that collects, analyzes, and shares threat intelligence.

• Functions:
  • Collection: Gather intelligence from various sources.
  • Analysis: Analyze intelligence to identify threats.
  • Sharing: Share intelligence with other systems.
  • Integration: Integrate with SIEM and other tools.
• Examples:
  • MISP: Open-source threat intelligence platform.
  • Anomali: Commercial threat intelligence platform.
  • ThreatConnect: Commercial threat intelligence platform.

Lesson 5: Threat Intelligence-Driven SOC Operations

Definition: Threat intelligence-driven SOC operations use intelligence to guide detection and response.

• Steps:
  • Collect: Gather intelligence.
  • Analyze: Identify threats.
  • Prioritize: Focus on the most critical threats.
  • Respond: Take action to mitigate threats.
  • Learn: Use insights to improve.

Lesson 6: Threat Hunting Significance

Definition: Threat hunting is the proactive search for threats that have evaded detection.

Why it is important: Threat hunting helps organizations find and eliminate threats before they cause damage.

• Benefits:
  • Proactive: Find threats before they cause damage.
  • Early detection: Catch threats early.
  • Improved response: Enhance incident response.
  • Continuous improvement: Improve security posture.

Lesson 7: Threat Hunting Frameworks

Definition: Threat hunting frameworks provide structured approaches to hunting.

• MITRE ATT&CK: Provides a common language for describing threats.
• Cyber Kill Chain: Describes the stages of an attack.
• Diamond Model: Analyzes adversary activity.

Lesson 8: Threat Hunting with PowerShell

Definition: PowerShell is a powerful tool for threat hunting on Windows systems.

• Commands:
  • Get-Process: List running processes.
  • Get-Service: List services.
  • Get-EventLog: View event logs.
  • Get-WinEvent: Query event logs.

Lesson 9: Threat Hunting with YARA

Definition: YARA is a tool for identifying malware based on patterns in files or processes.

• YARA rules: Define patterns to search for.
• Applications:
  • Malware detection: Identify malware.
  • Threat hunting: Search for threats.
  • Incident response: Investigate incidents.

Lesson 10: Structured and Unstructured Threat Hunting

Definition: Threat hunting can be structured or unstructured.

• Structured: Following a defined methodology (e.g., MITRE ATT&CK).
• Unstructured: Ad-hoc searching based on intuition.

Lesson 11: Data Transformation Techniques

Definition: Data transformation techniques convert data into a format suitable for analysis.

• Normalization: Standardizing data formats.
• Enrichment: Adding context to data.
• Aggregation: Summarizing data.
• Filtering: Removing irrelevant data.

Lesson 12: Threat Hunting Best Practices

Definition: Best practices for effective threat hunting.

• Use threat intelligence: Guide hunts with intelligence.
• Use frameworks: Apply MITRE ATT&CK and other frameworks.
• Collaborate: Work with other analysts.
• Document findings: Record what you find.
• Continuously improve: Learn from each hunt.

Key Vocabulary

Important Concepts

• Threat intelligence provides information about threats.
• Threat intelligence platforms collect, analyze, and share intelligence.
• Threat intelligence-driven SOC operations use intelligence to guide detection and response.
• Threat hunting is the proactive search for threats.
• MITRE ATT&CK provides a common language for describing threats.
• PowerShell and YARA are powerful tools for threat hunting.

Step-by-Step Explanations

How to Conduct a Threat Hunt

1. Define the scope and objectives.
2. Formulate a hypothesis.
3. Gather data from multiple sources.
4. Analyze the data.
5. Investigate findings.
6. Document the findings.
7. Take action.

How to Use MITRE ATT&CK for Hunting

1. Identify the threat you are hunting for.
2. Map the threat to MITRE ATT&CK tactics and techniques.
3. Create detection rules based on the mapping.
4. Search for evidence of the techniques.
5. Investigate and respond to findings.

Real-Life Examples

• In a business: A company uses threat hunting to detect APTs.
• In a school: A school uses threat hunting to protect student data.
• In a hospital: A hospital uses threat hunting to protect patient data.
• In Nigeria: A bank uses threat hunting to detect fraud.

Nigerian Examples

• A bank in Lagos uses threat hunting to detect APTs.
• A telecom company in Abuja uses MITRE ATT&CK for hunting.
• A hospital in Kano uses threat hunting to protect patient data.
• A government agency in Enugu uses threat intelligence.

Fun Examples Children Can Relate To

• A detective searching for clues (threat hunting).
• A security guard patrolling a building (proactive defense).
• A spy gathering intelligence (threat intelligence).
• A detective using a magnifying glass (YARA).

Everyday Examples

• Searching for lost keys (threat hunting).
• Checking your home for intruders (proactive defense).
• Gathering information about a potential threat (threat intelligence).
• Using a magnifying glass (YARA).

Teacher Notes

• Emphasize the importance of proactive defense.
• Use real-world examples to illustrate concepts.
• Discuss the role of MITRE ATT&CK in threat hunting.
• Encourage students to practice threat hunting.

Parent Tips

• Help your child understand the importance of proactive security.
• Discuss how to search for threats.
• Encourage them to think about threat intelligence.
• Support their interest in cybersecurity careers.

Interesting Facts

• Threat hunting was first introduced in the 2010s.
• MITRE ATT&CK was first released in 2013.
• YARA was created by Victor M. Alvarez in 2011.
• PowerShell was first released in 2006.

Did You Know?

Remember This

• Threat intelligence provides information about threats.
• Threat intelligence platforms collect, analyze, and share intelligence.
• Threat hunting is the proactive search for threats.
• MITRE ATT&CK provides a common language for describing threats.
• PowerShell and YARA are powerful tools for threat hunting.

Common Mistakes

• Not using threat intelligence: Intelligence guides hunts.
• Not using frameworks: Frameworks provide structure.
• Not documenting findings: Without documentation, you cannot learn.
• Not collaborating: Hunting alone is less effective.
• Not continuously improving: Learning is essential.

Best Practices

• Use threat intelligence.
• Use frameworks.
• Collaborate with other analysts.
• Document findings.
• Continuously improve.

Comparison: Threat Intelligence Types

Type	Description	Audience
Strategic	High-level insights	Decision-makers
Tactical	TTPs	Analysts
Operational	Specific threat information	Operators
Technical	IoCs	Technical staff

Comparison: Structured vs Unstructured Hunting

Feature	Structured	Unstructured
Methodology	Defined	Ad-hoc
Consistency	High	Low
Best for	Large organizations	Small teams

End-of-Module Summary

Congratulations! You have completed Module Five. You now know:

• Threat intelligence fundamentals, types, and sources.
• Threat intelligence platforms (TIP).
• Threat intelligence-driven SOC operations.
• Threat hunting significance and frameworks.
• Threat hunting with PowerShell and YARA.
• Structured and unstructured threat hunting.
• Data transformation techniques.
• Best practices for threat hunting.

You are now ready to move on to Module Six, where you will learn about Incident Response and Investigation.

Frequently Asked Questions

1. What is threat intelligence? Information about threats.
2. What are TTPs? Tactics, Techniques, and Procedures.
3. What are IoCs? Indicators of Compromise.
4. What is OSINT? Open-Source Intelligence.
5. What is a TIP? Threat Intelligence Platform.
6. What is threat hunting? Proactive search for threats.
7. What is YARA? A tool for identifying malware.
8. What is MITRE ATT&CK? A knowledge base of adversary tactics and techniques.
9. What is data transformation? Converting data into a suitable format.
10. What is enrichment? Adding context to data.

Review Questions

1. What is threat intelligence?
2. What are the types of threat intelligence?
3. What are threat intelligence sources?
4. What is a threat intelligence platform?
5. What is threat hunting?
6. What are threat hunting frameworks?
7. What is PowerShell used for in threat hunting?
8. What is YARA used for?
9. What is the difference between structured and unstructured hunting?
10. What are data transformation techniques?
11. What is the difference between strategic and tactical intelligence?
12. What is the difference between OSINT and commercial intelligence?
13. What is the role of threat intelligence in SOC operations?
14. What are the best practices for threat hunting?
15. How do you conduct a threat hunt?

Fill-in-the-Blank Exercises

1. __________ is information about threats.
2. __________ are Tactics, Techniques, and Procedures.
3. __________ are Indicators of Compromise.
4. __________ stands for Open-Source Intelligence.
5. A __________ is a Threat Intelligence Platform.
6. __________ is the proactive search for threats.
7. __________ is a tool for identifying malware.
8. __________ is a knowledge base of adversary tactics and techniques.
9. __________ converts data into a suitable format.
10. __________ adds context to data.

True or False

1. Threat intelligence is not important. (False)
2. TTPs are tactics, techniques, and procedures. (True)
3. IoCs are indicators of compromise. (True)
4. OSINT is not a threat intelligence source. (False)
5. A TIP collects and analyzes threat intelligence. (True)
6. Threat hunting is reactive. (False)
7. YARA is a tool for identifying malware. (True)
8. MITRE ATT&CK is a commercial tool. (False)
9. Data transformation is not important. (False)
10. Enrichment adds context to data. (True)

Multiple Choice Questions

1. What is threat intelligence?
   a) Information about threats b) A type of software c) A hardware device d) A threat
   Answer: a
2. What are TTPs?
   a) Tactics, Techniques, and Procedures b) A type of software c) A hardware device d) A threat
   Answer: a
3. What are IoCs?
   a) Indicators of Compromise b) A type of software c) A hardware device d) A threat
   Answer: a
4. What is OSINT?
   a) Open-Source Intelligence b) A type of software c) A hardware device d) A threat
   Answer: a
5. What is a TIP?
   a) A Threat Intelligence Platform b) A type of software c) A hardware device d) A threat
   Answer: a
6. What is threat hunting?
   a) Proactive search for threats b) A type of software c) A hardware device d) A threat
   Answer: a
7. What is YARA?
   a) A tool for identifying malware b) A type of software c) A hardware device d) A threat
   Answer: a
8. What is MITRE ATT&CK?
   a) A knowledge base of adversary tactics and techniques b) A type of software c) A hardware device d) A threat
   Answer: a
9. What is data transformation?
   a) Converting data into a suitable format b) A type of software c) A hardware device d) A threat
   Answer: a
10. What is enrichment?
    a) Adding context to data b) A type of software c) A hardware device d) A threat
    Answer: a
11. What is the difference between strategic and tactical intelligence?
    a) Strategic is high-level; tactical is detailed b) They are the same c) Tactical is high-level; strategic is detailed d) None
    Answer: a
12. What is the difference between OSINT and commercial intelligence?
    a) OSINT is free; commercial is paid b) They are the same c) Commercial is free; OSINT is paid d) None
    Answer: a
13. What is the role of threat intelligence in SOC operations?
    a) It guides detection and response b) It is not important c) It only generates alerts d) None
    Answer: a
14. What are the best practices for threat hunting?
    a) Use threat intelligence, use frameworks, collaborate, document findings, continuously improve b) Only use threat intelligence c) Only use frameworks d) None
    Answer: a
15. How do you conduct a threat hunt?
    a) Define scope, formulate a hypothesis, gather data, analyze, investigate, document, take action b) Only define scope c) Only gather data d) None
    Answer: a

Matching Exercises

Match the term on the left with its description on the right.

Term	Description
1. Threat Intelligence	A. Proactive search for threats
2. Threat Hunting	B. Information about threats
3. MITRE ATT&CK	C. Tool for identifying malware
4. YARA	D. Knowledge base of adversary tactics and techniques
5. TIP	E. Threat Intelligence Platform

Answers: 1-B, 2-A, 3-D, 4-C, 5-E

Short Answer Questions

1. What is the difference between strategic and tactical intelligence?
2. What is the difference between OSINT and commercial intelligence?
3. What is the role of threat intelligence in SOC operations?
4. What are the best practices for threat hunting?
5. How do you conduct a threat hunt?

Scenario-Based Exercises

1. Scenario: You are a SOC analyst. You want to start threat hunting. What steps would you take?
2. Scenario: You have received threat intelligence about a new attack campaign. How would you use it?
3. Scenario: You have identified a potential threat. How would you investigate it?

Group Activity

In groups of 3-4, conduct a mock threat hunt. Develop a hypothesis, gather data, and analyze it. Present your findings to the class.

Individual Activity

Write a one-page report on a threat hunting case study. Include the hypothesis, methodology, findings, and lessons learned.

Classroom Discussion Questions

1. Why is threat hunting important for SOCs?
2. What are the challenges of threat hunting?
3. How can organizations integrate threat intelligence?
4. What is the role of MITRE ATT&CK in threat hunting?
5. How can organizations improve their threat hunting capabilities?

Mini Project

Project: "Threat Hunting Plan." Create a threat hunting plan for a fictional organization. Include objectives, methodologies, data sources, and tools. Present your plan to the class.

Practical Assignment

Create a threat hunting plan for a specific threat (e.g., ransomware). Include the hypothesis, data sources, and steps to investigate.

Challenge Exercise

Research a real-world threat hunting case study. Write a one-page summary of the case study and what was learned.

Quiz Answers

Fill-in-the-Blank Answers:

1. Threat intelligence
2. TTPs
3. IoCs
4. OSINT
5. TIP
6. Threat hunting
7. YARA
8. MITRE ATT&CK
9. Data transformation
10. Enrichment

True or False Answers: 1-F, 2-T, 3-T, 4-F, 5-T, 6-F, 7-T, 8-F, 9-F, 10-T

Key Takeaways

• Threat intelligence provides information about threats.
• Threat intelligence platforms collect, analyze, and share intelligence.
• Threat hunting is the proactive search for threats.
• MITRE ATT&CK provides a common language for describing threats.
• PowerShell and YARA are powerful tools for threat hunting.

Preparation for the Next Module

In Module Six, you will learn about Incident Response and Investigation. You will explore incident response processes, playbooks, and tools.

---

MODULE 7

Forensics Investigation and Malware Analysis

Module Introduction

Welcome to Module Seven of your Certified Security Operations Centre Analyst Level 2 course! In this module, we will explore forensics investigation and malware analysis. You will learn how to investigate incidents, analyze malware, and recover evidence.

Think of forensics as cybersecurity detective work. By the end of this module, you will be able to conduct forensic investigations and analyze malware.

Learning Objectives

By the end of this module, you will be able to:

• Understand forensic investigation fundamentals.
• Investigate network, application, email, and insider incidents.
• Perform static and dynamic malware analysis.
• Use Volatility for memory analysis.
• Collect triage artifacts with KAPE.
• Use Velociraptor for incident response.

---

Warm‑up Story

Ngozi's Forensics Investigation

Ngozi was a Tier 2 SOC analyst at a bank in Lagos. She received an alert about a potential malware infection. She started a forensic investigation.

She used Volatility to analyze memory dumps and identify malicious processes. She used KAPE to collect triage artifacts. She used Velociraptor to investigate endpoints. Her investigation revealed a new malware variant.

Ngozi's forensic skills helped the team contain the incident. She learned that forensics is essential for incident response.

Main Lessons

Lesson 1: Forensic Investigation Fundamentals

Definition: Forensic investigation is the process of collecting, preserving, and analyzing digital evidence.

Why it is important: Forensics helps organizations understand what happened and gather evidence for legal proceedings.

• Real‑life example: A company uses forensics to investigate a data breach.
• School example: A school uses forensics to investigate a cyber incident.
• Home example: A family uses forensics to investigate a security incident.
• Nigerian example: A bank uses forensics to investigate fraud.

Lesson 2: Investigating Network Incidents

Definition: Network forensics involves analyzing network traffic to identify malicious activity.

• Steps:
  • Capture: Capture network packets.
  • Analyze: Analyze packet data.
  • Correlate: Correlate with other evidence.
  • Report: Document findings.

Lesson 3: Investigating Application Incidents

Definition: Application forensics involves analyzing application logs and data to identify malicious activity.

• Steps:
  • Collect: Collect application logs.
  • Analyze: Analyze log data.
  • Correlate: Correlate with other evidence.
  • Report: Document findings.

Lesson 4: Investigating Email Incidents

Definition: Email forensics involves analyzing email traffic and content to identify malicious activity.

• Steps:
  • Collect: Collect email logs and content.
  • Analyze: Analyze email data.
  • Correlate: Correlate with other evidence.
  • Report: Document findings.

Lesson 5: Investigating Insider Incidents

Definition: Insider forensics involves investigating malicious activity from within the organization.

• Steps:
  • Collect: Collect user activity logs.
  • Analyze: Analyze user behavior.
  • Correlate: Correlate with other evidence.
  • Report: Document findings.

Lesson 6: Malware Analysis – Static Analysis

Definition: Static analysis involves examining malware without executing it.

• Steps:
  • File properties: Examine file metadata.
  • Strings: Extract human-readable strings.
  • Code analysis: Disassemble the code.
  • Tools: PeStudio, IDA.

Lesson 7: Malware Analysis – Dynamic Analysis

Definition: Dynamic analysis involves executing malware in a sandbox to observe its behavior.

• Steps:
  • Sandbox: Execute malware in a sandbox.
  • Behavior: Observe file system, registry, and network activity.
  • Tools: Process Explorer, Process Monitor, Wireshark.

Lesson 8: Memory Analysis with Volatility

Definition: Volatility is a framework for analyzing memory dumps.

• Commands:
  • pslist: List processes.
  • netscan: List network connections.
  • cmdline: List command-line arguments.
  • dlllist: List loaded DLLs.

Lesson 9: Triage Artifact Collection with KAPE

Definition: KAPE (Kroll Artifact Parser and Extractor) is a tool for collecting and parsing forensic artifacts.

• Features:
  • Collection: Collect triage artifacts.
  • Parsing: Parse collected artifacts.
  • Automation: Automate collection and parsing.
• Use cases:
  • Incident response: Quickly collect evidence.
  • Forensic analysis: Parse collected artifacts.

Lesson 10: Incident Response with Velociraptor

Definition: Velociraptor is a tool for incident response and digital forensics.

• Features:
  • Collection: Collect forensic artifacts.
  • Analysis: Analyze collected data.
  • Response: Respond to incidents.
• Use cases:
  • Incident response: Investigate and respond to incidents.
  • Forensic analysis: Conduct forensic analysis.

Key Vocabulary

Important Concepts

• Forensic investigation collects, preserves, and analyzes digital evidence.
• Network, application, email, and insider incidents require different forensic approaches.
• Static analysis examines malware without execution.
• Dynamic analysis executes malware in a sandbox.
• Volatility is a memory forensics framework.
• KAPE collects and parses forensic artifacts.
• Velociraptor is used for incident response and forensics.

Step-by-Step Explanations

How to Perform Static Analysis

1. Identify the malware file.
2. Check file properties (size, creation date).
3. Extract strings from the file.
4. Analyze the file structure using PeStudio.
5. Disassemble the file using IDA.

How to Perform Dynamic Analysis

1. Set up a sandbox environment.
2. Execute the malware in the sandbox.
3. Monitor file system, registry, and network activity.
4. Use Process Monitor and Process Explorer.
5. Capture network traffic with Wireshark.

Real-Life Examples

• In a business: A company uses Volatility to analyze memory dumps.
• In a school: A school uses KAPE to collect triage artifacts.
• In a hospital: A hospital uses Velociraptor for incident response.
• In Nigeria: A bank uses forensics to investigate fraud.

Nigerian Examples

• A bank in Lagos uses Volatility for memory analysis.
• A telecom company in Abuja uses KAPE for triage.
• A hospital in Kano uses Velociraptor for incident response.
• A government agency in Enugu uses forensics for investigations.

Fun Examples Children Can Relate To

• A detective examining clues (forensics).
• A scientist studying a virus (malware analysis).
• A security guard watching cameras (network forensics).
• A librarian organizing books (KAPE).

Everyday Examples

• Examining a suspicious email (email forensics).
• Running a program in a virtual machine (dynamic analysis).
• Checking your bank account for fraud (network forensics).
• Organizing your files (KAPE).

Teacher Notes

• Emphasize the importance of forensics in incident response.
• Use real-world examples to illustrate concepts.
• Discuss the role of Volatility, KAPE, and Velociraptor.
• Encourage students to practice with forensic tools.

Parent Tips

• Help your child understand the importance of forensics.
• Discuss how to investigate digital evidence.
• Encourage them to think about forensic careers.
• Support their interest in cybersecurity.

Interesting Facts

• Volatility is used by many forensic investigators.
• KAPE was developed by Kroll.
• Velociraptor is open-source.
• Static analysis is often the first step in malware analysis.

Did You Know?

Remember This

• Forensic investigation collects, preserves, and analyzes digital evidence.
• Network, application, email, and insider incidents require different forensic approaches.
• Static analysis examines malware without execution.
• Dynamic analysis executes malware in a sandbox.
• Volatility is a memory forensics framework.
• KAPE collects and parses forensic artifacts.
• Velociraptor is used for incident response and forensics.

Common Mistakes

• Not preserving evidence: Evidence must be preserved.
• Not using a sandbox: Malware could infect your system.
• Not documenting findings: Without documentation, you cannot learn.
• Not collaborating: Sharing findings helps the community.
• Not staying updated: Threats evolve constantly.

Best Practices

• Preserve evidence.
• Use a sandbox for dynamic analysis.
• Document findings.
• Collaborate with other analysts.
• Stay updated on new threats and techniques.

Comparison: Static vs Dynamic Analysis

Feature	Static	Dynamic
Execution	No	Yes
Risk	Low	Medium
Insight	Code structure	Behavior
Best for	Initial analysis	Detailed analysis

Comparison: Forensics Tools

Tool	Purpose	Best for
Volatility	Memory analysis	Memory dumps
KAPE	Artifact collection	Triage
Velociraptor	Incident response	Forensics and response

End-of-Module Summary

Congratulations! You have completed Module Seven. You now know:

• Forensic investigation fundamentals.
• How to investigate network, application, email, and insider incidents.
• How to perform static and dynamic malware analysis.
• How to use Volatility for memory analysis.
• How to collect triage artifacts with KAPE.
• How to use Velociraptor for incident response.

You are now ready to move on to Module Eight, where you will learn about SOC for Cloud Environments.

Frequently Asked Questions

1. What is forensic investigation? Collecting, preserving, and analyzing digital evidence.
2. What is static analysis? Examining malware without executing it.
3. What is dynamic analysis? Executing malware in a sandbox.
4. What is Volatility? A memory forensics framework.
5. What is KAPE? A tool for collecting and parsing forensic artifacts.
6. What is Velociraptor? A tool for incident response and digital forensics.
7. What is a sandbox? A controlled environment for executing malware.
8. What is a memory dump? A snapshot of system memory.
9. What are triage artifacts? Key evidence collected quickly.
10. What is chain of custody? A record of evidence handling.

Review Questions

1. What is forensic investigation?
2. What is static analysis?
3. What is dynamic analysis?
4. What is Volatility?
5. What is KAPE?
6. What is Velociraptor?
7. What is a sandbox?
8. What is a memory dump?
9. What are triage artifacts?
10. What is chain of custody?
11. What is the difference between static and dynamic analysis?
12. What is the difference between Volatility and KAPE?
13. How do you perform static analysis?
14. How do you perform dynamic analysis?
15. What is the role of Velociraptor in incident response?

Fill-in-the-Blank Exercises

1. __________ is collecting, preserving, and analyzing digital evidence.
2. __________ examines malware without executing it.
3. __________ executes malware in a sandbox.
4. __________ is a memory forensics framework.
5. __________ is a tool for collecting and parsing forensic artifacts.
6. __________ is a tool for incident response and digital forensics.
7. A __________ is a controlled environment for executing malware.
8. A __________ is a snapshot of system memory.
9. __________ are key evidence collected quickly.
10. __________ is a record of evidence handling.

True or False

1. Forensic investigation collects evidence. (True)
2. Static analysis executes malware. (False)
3. Dynamic analysis executes malware in a sandbox. (True)
4. Volatility is a memory forensics framework. (True)
5. KAPE is a malware analysis tool. (False)
6. Velociraptor is used for incident response. (True)
7. A sandbox is a controlled environment. (True)
8. A memory dump is a snapshot of memory. (True)
9. Triage artifacts are not important. (False)
10. Chain of custody is a record of evidence handling. (True)

Multiple Choice Questions

1. What is forensic investigation?
   a) Collecting, preserving, and analyzing evidence b) A type of software c) A hardware device d) A threat
   Answer: a
2. What is static analysis?
   a) Examining malware without executing it b) Executing malware in a sandbox c) A type of software d) A hardware device
   Answer: a
3. What is dynamic analysis?
   a) Executing malware in a sandbox b) Examining malware without executing it c) A type of software d) A hardware device
   Answer: a
4. What is Volatility?
   a) A memory forensics framework b) A type of software c) A hardware device d) A threat
   Answer: a
5. What is KAPE?
   a) A tool for collecting and parsing forensic artifacts b) A type of software c) A hardware device d) A threat
   Answer: a
6. What is Velociraptor?
   a) A tool for incident response and digital forensics b) A type of software c) A hardware device d) A threat
   Answer: a
7. What is a sandbox?
   a) A controlled environment for executing malware b) A type of software c) A hardware device d) A threat
   Answer: a
8. What is a memory dump?
   a) A snapshot of system memory b) A type of software c) A hardware device d) A threat
   Answer: a
9. What are triage artifacts?
   a) Key evidence collected quickly b) A type of software c) A hardware device d) A threat
   Answer: a
10. What is chain of custody?
    a) A record of evidence handling b) A type of software c) A hardware device d) A threat
    Answer: a
11. What is the difference between static and dynamic analysis?
    a) Static is without execution; dynamic is with execution b) They are the same c) Dynamic is without execution; static is with execution d) None
    Answer: a
12. What is the difference between Volatility and KAPE?
    a) Volatility is for memory; KAPE is for artifacts b) They are the same c) KAPE is for memory; Volatility is for artifacts d) None
    Answer: a
13. How do you perform static analysis?
    a) Analyze file properties, strings, and code b) Execute the malware c) Use a sandbox d) None
    Answer: a
14. How do you perform dynamic analysis?
    a) Execute the malware in a sandbox b) Analyze file properties c) Extract strings d) None
    Answer: a
15. What is the role of Velociraptor in incident response?
    a) Investigate and respond to incidents b) A type of software c) A hardware device d) A threat
    Answer: a

Matching Exercises

Match the term on the left with its description on the right.

Term	Description
1. Static Analysis	A. Executes malware in a sandbox
2. Dynamic Analysis	B. Examines malware without execution
3. Volatility	C. Memory forensics framework
4. KAPE	D. Collects and parses artifacts
5. Velociraptor	E. Incident response and forensics

Answers: 1-B, 2-A, 3-C, 4-D, 5-E

Short Answer Questions

1. What is the difference between static and dynamic analysis?
2. What is the difference between Volatility and KAPE?
3. How do you perform static analysis?
4. How do you perform dynamic analysis?
5. What is the role of Velociraptor in incident response?

Scenario-Based Exercises

1. Scenario: You are a SOC analyst. You have received a suspicious file. How would you analyze it?
2. Scenario: You need to analyze a memory dump. How would you use Volatility?
3. Scenario: You need to collect triage artifacts. How would you use KAPE?

Group Activity

In groups of 3-4, analyze a sample malware file. Use static and dynamic analysis techniques. Present your findings to the class.

Individual Activity

Write a one-page report on a forensic tool of your choice (Volatility, KAPE, or Velociraptor). Include its features and use cases.

Classroom Discussion Questions

1. Why is forensics important for SOCs?
2. What are the challenges of forensic investigation?
3. How can organizations improve their forensic capabilities?
4. What is the role of Volatility in incident response?
5. How can KAPE help with incident response?

Mini Project

Project: "Forensics Investigation." Conduct a forensic investigation for a fictional incident. Use Volatility, KAPE, and Velociraptor. Present your findings to the class.

Practical Assignment

Analyze a memory dump using Volatility. Identify malicious processes, network connections, and command history. Write a report on your findings.

Challenge Exercise

Research a real-world forensic case study. Write a one-page summary of the case study and what was learned.

Quiz Answers

Fill-in-the-Blank Answers:

1. Forensic investigation
2. Static analysis
3. Dynamic analysis
4. Volatility
5. KAPE
6. Velociraptor
7. sandbox
8. memory dump
9. Triage artifacts
10. Chain of custody

True or False Answers: 1-T, 2-F, 3-T, 4-T, 5-F, 6-T, 7-T, 8-T, 9-F, 10-T

Key Takeaways

• Forensic investigation collects, preserves, and analyzes digital evidence.
• Static analysis examines malware without execution.
• Dynamic analysis executes malware in a sandbox.
• Volatility is a memory forensics framework.
• KAPE collects and parses forensic artifacts.
• Velociraptor is used for incident response and forensics.

Preparation for the Next Module

In Module Eight, you will learn about SOC for Cloud Environments. You will explore Azure SOC, AWS SOC, and GCP SOC.

---

MODULE 8

SOC for Cloud Environments

Module Introduction

Welcome to Module Eight of your Certified Security Operations Centre Analyst Level 2 course! In this module, we will explore SOC for cloud environments. You will learn how to extend SOC capabilities to the cloud.

Think of this module as taking the SOC to the cloud. By the end of this module, you will understand how to secure cloud environments using SOC principles and tools.

Learning Objectives

By the end of this module, you will be able to:

• Understand Cloud SOC concepts.
• Design Azure SOC Architecture and use Microsoft Sentinel.
• Design AWS SOC Architecture and use AWS Security Hub.
• Design GCP SOC and use Security Command Center.
• Use cloud-native security tools and integrations.

---

Warm‑up Story

Chidi's Cloud SOC Journey

Chidi was a Tier 2 SOC analyst at a bank in Lagos. The bank was migrating to the cloud, and Chidi needed to extend the SOC to the cloud.

He designed an Azure SOC architecture using Microsoft Sentinel. He used AWS Security Hub for AWS workloads. He used GCP Security Command Center for Google Cloud. He integrated cloud-native security tools to monitor threats.

Chidi's cloud SOC helped the bank detect and respond to cloud-based threats. He learned that cloud security is essential for modern organizations.

Main Lessons

Lesson 1: Introduction to Cloud SOC

Definition: A Cloud SOC extends traditional SOC capabilities to cloud environments.

Why it is important: As organizations migrate to the cloud, they need to monitor and protect cloud resources.

• Real‑life example: A company uses a Cloud SOC to monitor AWS and Azure workloads.
• School example: A school uses a Cloud SOC to protect student data in the cloud.
• Home example: A family uses cloud security tools to protect their data.
• Nigerian example: A bank uses a Cloud SOC to protect cloud-based banking systems.

Lesson 2: Azure SOC Architecture

Definition: Azure SOC architecture uses Microsoft Sentinel to monitor and protect Azure workloads.

• Components:
  • Microsoft Sentinel: SIEM for Azure.
  • Azure Monitor: Monitoring service.
  • Azure Security Center: Security management.
  • Azure Log Analytics: Log collection and analysis.

Lesson 3: Microsoft Sentinel

Definition: Microsoft Sentinel is a cloud-native SIEM for Azure.

• Features:
  • Data collection: Collect logs from Azure and other sources.
  • Detection: Detect threats using analytics rules.
  • Investigation: Investigate incidents.
  • Response: Respond to threats.
  • AI: Uses AI for threat detection.

Lesson 4: AWS SOC Architecture

Definition: AWS SOC architecture uses AWS Security Hub to monitor and protect AWS workloads.

• Components:
  • AWS Security Hub: Centralized security management.
  • Amazon GuardDuty: Threat detection.
  • AWS Config: Configuration monitoring.
  • AWS CloudTrail: Log collection.

Lesson 5: AWS Security Hub

Definition: AWS Security Hub is a centralized security management service for AWS.

• Features:
  • Centralized view: Single view of security alerts.
  • Compliance: Check compliance with standards.
  • Integration: Integrate with other AWS services.
  • Automation: Automate response actions.

Lesson 6: GCP SOC Architecture

Definition: GCP SOC architecture uses Google Cloud Security Command Center to monitor and protect GCP workloads.

• Components:
  • Security Command Center: Centralized security management.
  • Cloud Audit Logs: Log collection.
  • Cloud Monitoring: Monitoring service.
  • Cloud Armor: Security policy management.

Lesson 7: Google Cloud Security Command Center

Definition: Security Command Center is a centralized security management service for GCP.

• Features:
  • Centralized view: Single view of security alerts.
  • Compliance: Check compliance with standards.
  • Integration: Integrate with other GCP services.
  • Automation: Automate response actions.

Lesson 8: Cloud-Native Security Tools

Definition: Cloud-native security tools are built specifically for cloud environments.

• Examples:
  • Azure Sentinel: SIEM for Azure.
  • AWS Security Hub: Security management for AWS.
  • GCP Security Command Center: Security management for GCP.
  • Cloudflare: Cloud security.

Lesson 9: Integration with Cloud-Native Tools

Definition: Integration connects cloud-native security tools with existing SOC tools.

• Examples:
  • SIEM integration: Connect cloud-native SIEM to on-premises SIEM.
  • SOAR integration: Automate response actions.
  • Threat intelligence integration: Use threat intelligence in cloud-native tools.

Lesson 10: Cloud SOC Best Practices

Definition: Best practices for effective Cloud SOC operations.

• Use cloud-native tools: Leverage built-in cloud security tools.
• Integrate with existing SOC: Connect cloud and on-premises.
• Monitor continuously: Monitor cloud environments 24/7.
• Automate response: Use automation to respond to threats.
• Stay updated: Keep up with cloud security trends.

Key Vocabulary

Important Concepts

• A Cloud SOC extends traditional SOC to cloud environments.
• Azure SOC uses Microsoft Sentinel, Azure Monitor, and Azure Security Center.
• AWS SOC uses AWS Security Hub, GuardDuty, and AWS Config.
• GCP SOC uses Security Command Center, Cloud Audit Logs, and Cloud Monitoring.
• Cloud-native tools are built specifically for cloud environments.
• Integration connects cloud-native tools with existing SOC.

Step-by-Step Explanations

How to Set Up Azure SOC

1. Enable Microsoft Sentinel.
2. Connect data sources (Azure Monitor, Azure Security Center).
3. Create analytics rules for threat detection.
4. Create dashboards for visualization.
5. Set up alerts and automation.

How to Set Up AWS SOC

1. Enable AWS Security Hub.
2. Enable GuardDuty for threat detection.
3. Configure AWS Config for compliance.
4. Create custom rules and alerts.
5. Integrate with existing SOC tools.

Real-Life Examples

• In a business: A company uses Azure Sentinel to monitor Azure workloads.
• In a school: A school uses AWS Security Hub to protect AWS workloads.
• In a hospital: A hospital uses GCP Security Command Center to protect patient data.
• In Nigeria: A bank uses a Cloud SOC to monitor cloud-based banking systems.

Nigerian Examples

• A bank in Lagos uses Azure Sentinel for cloud security.
• A telecom company in Abuja uses AWS Security Hub.
• A hospital in Kano uses GCP Security Command Center.
• A government agency in Enugu uses cloud-native security tools.

Fun Examples Children Can Relate To

• A security guard watching the cloud (Cloud SOC).
• A detective using a magnifying glass (security tools).
• A librarian organizing books (compliance).
• A robot automating tasks (automation).

Everyday Examples

• Using a security camera to monitor your home (Cloud SOC).
• Using a checklist to ensure compliance (compliance).
• Using a robot to clean your house (automation).
• Using a map to find your way (integration).

Teacher Notes

• Emphasize the importance of cloud security.
• Use real-world examples to illustrate concepts.
• Discuss the role of cloud-native tools.
• Encourage students to practice with cloud security tools.

Parent Tips

• Help your child understand the importance of cloud security.
• Discuss how organizations protect cloud data.
• Encourage them to think about cloud security careers.
• Support their interest in cybersecurity.

Interesting Facts

• Azure Sentinel was released in 2019.
• AWS Security Hub was released in 2018.
• GCP Security Command Center was released in 2019.
• Cloud security is a growing field.

Did You Know?

Remember This

• A Cloud SOC extends traditional SOC to cloud environments.
• Azure SOC uses Microsoft Sentinel, Azure Monitor, and Azure Security Center.
• AWS SOC uses AWS Security Hub, GuardDuty, and AWS Config.
• GCP SOC uses Security Command Center, Cloud Audit Logs, and Cloud Monitoring.
• Cloud-native tools are built specifically for cloud environments.
• Integration connects cloud-native tools with existing SOC.

Common Mistakes

• Not using cloud-native tools: Built-in tools are essential.
• Not integrating with existing SOC: Integration is key.
• Not monitoring continuously: Continuous monitoring is essential.
• Not automating response: Automation improves efficiency.
• Not staying updated: Cloud security evolves rapidly.

Best Practices

• Use cloud-native tools.
• Integrate with existing SOC.
• Monitor continuously.
• Automate response.
• Stay updated.

Comparison: Cloud SOC Platforms

Feature	Azure	AWS	GCP
SIEM	Microsoft Sentinel	AWS Security Hub	Security Command Center
Monitoring	Azure Monitor	AWS Config	Cloud Monitoring
Logging	Azure Log Analytics	AWS CloudTrail	Cloud Audit Logs
Threat Detection	Sentinel AI	GuardDuty	Security Command Center

Comparison: Cloud-Native Tools

Tool	Purpose	Best for
Azure Sentinel	SIEM	Azure workloads
AWS Security Hub	Security management	AWS workloads
GCP Security Command Center	Security management	GCP workloads

End-of-Module Summary

Congratulations! You have completed Module Eight. You now know:

• What a Cloud SOC is and why it is important.
• Azure SOC architecture and Microsoft Sentinel.
• AWS SOC architecture and AWS Security Hub.
• GCP SOC architecture and Security Command Center.
• Cloud-native security tools and integration.
• Best practices for Cloud SOC.

You have now completed all eight modules of the Certified SOC Analyst Level 2 course. You are ready to work as a Tier 2 SOC Analyst.

Frequently Asked Questions

1. What is a Cloud SOC? A SOC that monitors cloud environments.
2. What is Azure Sentinel? Cloud-native SIEM for Azure.
3. What is AWS Security Hub? Centralized security management for AWS.
4. What is GCP Security Command Center? Centralized security management for GCP.
5. What are cloud-native tools? Built specifically for cloud environments.
6. What is integration? Connecting cloud-native tools with existing SOC.
7. What is continuous monitoring? Monitoring environments 24/7.
8. What is automation? Automating response actions.
9. What is compliance? Ensuring cloud environments meet standards.
10. What are the best practices for Cloud SOC? Use cloud-native tools, integrate with existing SOC, monitor continuously, automate response, stay updated.

Review Questions

1. What is a Cloud SOC?
2. What is Azure Sentinel?
3. What is AWS Security Hub?
4. What is GCP Security Command Center?
5. What are cloud-native tools?
6. What is integration?
7. What is continuous monitoring?
8. What is automation?
9. What is compliance?
10. What are the best practices for Cloud SOC?
11. What is the difference between Azure Sentinel and AWS Security Hub?
12. What is the difference between AWS Security Hub and GCP Security Command Center?
13. How do you set up Azure SOC?
14. How do you set up AWS SOC?
15. What is the role of cloud-native tools in Cloud SOC?

Fill-in-the-Blank Exercises

1. A __________ monitors cloud environments.
2. __________ is a cloud-native SIEM for Azure.
3. __________ is centralized security management for AWS.
4. __________ is centralized security management for GCP.
5. __________ tools are built specifically for cloud environments.
6. __________ connects cloud-native tools with existing SOC.
7. __________ monitors environments 24/7.
8. __________ automates response actions.
9. __________ ensures cloud environments meet standards.
10. Best practices for Cloud SOC include using cloud-native tools, integrating with existing SOC, monitoring continuously, automating response, and __________.

True or False

1. A Cloud SOC monitors cloud environments. (True)
2. Azure Sentinel is a cloud-native SIEM for AWS. (False)
3. AWS Security Hub is centralized security management for AWS. (True)
4. GCP Security Command Center is for Azure. (False)
5. Cloud-native tools are built for cloud environments. (True)
6. Integration is not important. (False)
7. Continuous monitoring is essential. (True)
8. Automation improves efficiency. (True)
9. Compliance is not important. (False)
10. Best practices for Cloud SOC include staying updated. (True)

Multiple Choice Questions

1. What is a Cloud SOC?
   a) A SOC that monitors cloud environments b) A type of software c) A hardware device d) A threat
   Answer: a
2. What is Azure Sentinel?
   a) Cloud-native SIEM for Azure b) Security management for AWS c) Security management for GCP d) None
   Answer: a
3. What is AWS Security Hub?
   a) Centralized security management for AWS b) Cloud-native SIEM for Azure c) Security management for GCP d) None
   Answer: a
4. What is GCP Security Command Center?
   a) Centralized security management for GCP b) Cloud-native SIEM for Azure c) Security management for AWS d) None
   Answer: a
5. What are cloud-native tools?
   a) Built specifically for cloud environments b) A type of software c) A hardware device d) A threat
   Answer: a
6. What is integration?
   a) Connecting cloud-native tools with existing SOC b) A type of software c) A hardware device d) A threat
   Answer: a
7. What is continuous monitoring?
   a) Monitoring environments 24/7 b) A type of software c) A hardware device d) A threat
   Answer: a
8. What is automation?
   a) Automating response actions b) A type of software c) A hardware device d) A threat
   Answer: a
9. What is compliance?
   a) Ensuring cloud environments meet standards b) A type of software c) A hardware device d) A threat
   Answer: a
10. What are the best practices for Cloud SOC?
    a) Use cloud-native tools, integrate with existing SOC, monitor continuously, automate response, stay updated b) Only use cloud-native tools c) Only integrate with existing SOC d) None
    Answer: a
11. What is the difference between Azure Sentinel and AWS Security Hub?
    a) Azure Sentinel is for Azure; AWS Security Hub is for AWS b) They are the same c) AWS Security Hub is for Azure; Azure Sentinel is for AWS d) None
    Answer: a
12. What is the difference between AWS Security Hub and GCP Security Command Center?
    a) AWS Security Hub is for AWS; GCP Security Command Center is for GCP b) They are the same c) GCP Security Command Center is for AWS; AWS Security Hub is for GCP d) None
    Answer: a
13. How do you set up Azure SOC?
    a) Enable Sentinel, connect data sources, create rules, create dashboards, set up alerts b) Only enable Sentinel c) Only connect data sources d) None
    Answer: a
14. How do you set up AWS SOC?
    a) Enable Security Hub, enable GuardDuty, configure Config, create rules, integrate b) Only enable Security Hub c) Only enable GuardDuty d) None
    Answer: a
15. What is the role of cloud-native tools in Cloud SOC?
    a) They provide built-in security for cloud environments b) A type of software c) A hardware device d) A threat
    Answer: a

Matching Exercises

Match the term on the left with its description on the right.

Term	Description
1. Cloud SOC	A. Centralized security management for AWS
2. Azure Sentinel	B. Cloud-native SIEM for Azure
3. AWS Security Hub	C. Centralized security management for GCP
4. GCP Security Command Center	D. A SOC that monitors cloud environments
5. Integration	E. Connecting cloud-native tools with existing SOC

Answers: 1-D, 2-B, 3-A, 4-C, 5-E

Short Answer Questions

1. What is the difference between Azure Sentinel and AWS Security Hub?
2. What is the difference between AWS Security Hub and GCP Security Command Center?
3. How do you set up Azure SOC?
4. How do you set up AWS SOC?
5. What is the role of cloud-native tools in Cloud SOC?

Scenario-Based Exercises

1. Scenario: You are a SOC analyst. Your organization is migrating to Azure. How would you set up a Cloud SOC?
2. Scenario: You need to secure AWS workloads. How would you use AWS Security Hub?
3. Scenario: You need to secure GCP workloads. How would you use Security Command Center?

Group Activity

In groups of 3-4, design a Cloud SOC architecture for a fictional organization. Choose a cloud provider (Azure, AWS, or GCP). Present your architecture to the class.

Individual Activity

Write a one-page report on a cloud-native security tool (Azure Sentinel, AWS Security Hub, or GCP Security Command Center). Include its features and use cases.

Classroom Discussion Questions

1. Why is Cloud SOC important?
2. What are the challenges of Cloud SOC?
3. How can organizations integrate cloud and on-premises SOC?
4. What is the role of automation in Cloud SOC?
5. How can organizations stay updated on cloud security trends?

Mini Project

Project: "Cloud SOC Architecture." Design a Cloud SOC architecture for a fictional organization. Choose a cloud provider and include the key components. Present your architecture to the class.

Practical Assignment

Design a Cloud SOC architecture for a fictional organization. Choose a cloud provider and document the key components and tools.

Challenge Exercise

Research a real-world Cloud SOC implementation. Write a one-page summary of the case study and what was learned.

Quiz Answers

Fill-in-the-Blank Answers:

1. Cloud SOC
2. Azure Sentinel
3. AWS Security Hub
4. GCP Security Command Center
5. Cloud-native
6. Integration
7. Continuous monitoring
8. Automation
9. Compliance
10. staying updated

True or False Answers: 1-T, 2-F, 3-T, 4-F, 5-T, 6-F, 7-T, 8-T, 9-F, 10-T

Key Takeaways

• A Cloud SOC extends traditional SOC to cloud environments.
• Azure SOC uses Microsoft Sentinel, Azure Monitor, and Azure Security Center.
• AWS SOC uses AWS Security Hub, GuardDuty, and AWS Config.
• GCP SOC uses Security Command Center, Cloud Audit Logs, and Cloud Monitoring.
• Cloud-native tools are built specifically for cloud environments.
• Integration connects cloud-native tools with existing SOC.

Congratulations!

You have now completed all eight modules of the Certified SOC Analyst Level 2 course. You are ready to work as a Tier 2 SOC Analyst. Keep learning, stay curious, and continue to improve your skills.

---