CySA+ exam prep: security operations
Like a SOC analyst you learn what normal looks like, find signs of malicious activity in network, endpoint, application, email and file data, and confirm them with SIEM queries and threat hunting.
Level 301 · 16 lessons · 12 practice labs
Lessons
Infrastructure and visibility
- Logging architecture: sources, time sync, retention
- Knowing normal: a baseline of processes, services and connections
- Network architecture and visibility points
- Identity and access through an operations lens
- Short task: write a server’s normal-behaviour report
Analysing malicious activity
- Network indicators: regular beaconing, unusual ports, exfiltration
- Host indicators: persistence, unauthorised software, resource use
- Application indicators: unexpected output, error logs, new accounts
- Email analysis: headers, attachments and links
- Analysing a suspicious file: hashes, strings and YARA
- Short task: trace the attack through mixed logs
Tools and process improvement
- Writing SIEM queries and tuning rules
- Threat intelligence: indicator feeds and confidence
- Hypothesis-driven threat hunting
- Automation and playbooks: handing repetitive work to the machine
- Capstone: triage and report the alerts of one SOC shift
Practice labs
- Record a server's normal process list: You record the processes, listening ports and scheduled jobs running at a quiet hour into a baseline file.
- Find three deviations from the baseline: You compare last week's baseline with today's state and find the new process, new port and new account.
- Align logs scrambled by clock drift: You work out the clock offset between two servers from their logs, align events on one timeline and reveal the true order.
- Find the host calling out at regular intervals: In connection records you identify the internal host connecting to the same outside address every five minutes and count the connections.
- Measure data leaving over an unusual port: In Bulutkuşu Ajans's flow records you report the volume and destination of data leaving over an unexpected port after hours.
- Catch a DNS tunnel with statistics: Using query length, subdomain count and entropy you find the client exfiltrating data over DNS and the domain used.
- Find an account created at night in the logs: In system logs you identify an account created outside working hours, who created it and the groups it was given.
- Sweep the persistence points: You sweep scheduled jobs, service units, shell profiles and authorised key files on a server and find two entries the attacker left.
- Write a YARA rule for a suspicious file: You examine a file's hash, strings and structure and write a YARA rule that catches it and two variants but no clean files.
- Write your first query for failed logins: In the log search interface you write a query counting the last 24 hours of failed logins per user.
- Tune a noisy rule: You tune a rule that fires hundreds of alerts a day with a threshold and an exception and show on sample events that it still catches the real attack.
- Hunt on a hypothesis: You form the hypothesis that an attacker is abusing admin tools, test it with queries and document the evidence you find or its absence.
About this course
Like a SOC analyst you learn what normal looks like, find signs of malicious activity in network, endpoint, application, email and file data, and confirm them with SIEM queries and threat hunting.
What you will learn
- Infrastructure and visibility
- Analysing malicious activity
- Tools and process improvement
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.