Job role capstone: security data analyst
You live a week as a security data analyst: a data request, cleaning, analysis, rule tuning, a dashboard, a report and peer review.
Level 401 · 12 lessons · 9 practice labs
Lessons
Start of the week
- The role and the week's tasks
- Clarifying a data request
- Quick task: an analysis plan for the request
Analysis
- Gathering and cleaning the sources
- Calculating alert and incident indicators
- An urgent question: investigating a suspicious account
- Tuning a noisy rule with data
- Quick task: a findings table
Delivery
- Updating the weekly dashboard
- The management report
- Putting the analysis through peer review
- Capstone: the weekly security analytics delivery
Practice labs
- Clarify a data request: Write the clarifying questions, scope and delivery format for the request “are remote workers risky?” to request.md.
- Combine and clean the sources: Join VPN, authentication and HR tables on a common key and produce an analysis table while documenting unmatched and duplicate records.
- An urgent question: a suspicious account: Within half an hour, gather an account's last seven days of activity from four sources and write an evidence-backed call on whether it is compromised.
- Calculate the weekly indicators: Compute alert count, true-incident rate and mean resolution time for this week and last and write the change.
- Tune a noisy rule with data: Study past alerts from the rule with the most false alarms and propose a threshold that halves the noise without missing real incidents.
- Prove a tuning proposal: Test a proposed rule change against the past 60 days of data and tabulate the analyst hours saved and the risk of missed incidents.
- Write the management summary: Write a half-page management summary from the weekly findings table with three key messages and one decision request.
- Update the dashboard for the new week: Run the weekly dashboard script on new data, fix a chart that broke and verify the numbers agree with the report.
- Peer-review a colleague's analysis: Find the wrong denominator, missing filter and unreproducible step in a colleague's analysis notebook and write them into a review note.
About this course
You live a week as a security data analyst: a data request, cleaning, analysis, rule tuning, a dashboard, a report and peer review.
What you will learn
- Start of the week
- Analysis
- Delivery
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.