Blue Team / SOC and Defense

About this path

The defender's day: triage in the SOC, network and endpoint monitoring, log pipelines and detection content, then forensics, incident response and the governance work that wraps around them.

Steps in this path

1. 1 Course SOC Fundamentals
2. 2 Lab Noisy Neighbor
3. 3 Course Defense in Depth
4. 4 Course MITRE ATT&CK Framework
5. 5 Course Threat Intelligence
6. 6 Course Network Security
7. 7 Lab Packet Whisper
8. 8 Course Wireshark
9. 9 Course tcpdump
10. 10 Course Zeek
11. 11 Course Suricata
12. 12 Course Snort
13. 13 Course DNS Security
14. 14 Course DNS Tunneling Detection
15. 15 Course Log Analysis
16. 16 Lab Brute-DDoS
17. 17 Course Windows Event Log Analysis
18. 18 Course Splunk
19. 19 Course Elastic Stack
20. 20 Course Sigma Rules
21. 21 Course SOAR Concepts
22. 22 Course Endpoint Security
23. 23 Course Sysinternals Suite
24. 24 Course Sysmon
25. 25 Course Sysmon Detection Engineering
26. 26 Course Identity and Access Management
27. 27 Course Credential Security
28. 28 Course Threat Hunting
29. 29 Lab Hunter's Log
30. 30 Course Insider Threat Detection
31. 31 Course Detecting AV and EDR Evasion
32. 32 Course Honeypots
33. 33 Course Digital Forensics
34. 34 Lab Shadowy Guild
35. 35 Lab DC Under Siege
36. 36 Lab Operation Goblin
37. 37 Course FTK Imager
38. 38 Course Autopsy
39. 39 Course Volatility
40. 40 Course Malware Analysis
41. 41 Lab ᚹᛅᛚᚴᛅ
42. 42 Course YARA
43. 43 Course Incident Management & Response
44. 44 Course Ransomware Response
45. 45 Course Log4Shell-Style Vulnerability Response
46. 46 Course Phishing Investigation
47. 47 Course Business Email Compromise (BEC)
48. 48 Course GRC
49. 49 Course Zero Trust Architecture
50. 50 Course Supply Chain Security
51. 51 Course Insider Risk Programs
52. 52 Course Tabletop Exercises
53. 53 Course Ransomware Negotiation and Legal Response