Identify and define different vulnerability assessments and analysis, threat research, and establish known-good and known-bad network baselines.

• Given a scenario within the threat landscape, identify common attack techniques and profiles that target common vulnerabilities
• Perform threat research and compare popular online vulnerability and blogs and databases
• Establish a known-good network baseline
• Validate the known-bad to a known-good baseline

Understand the importance and mechanisms of device logs, be able to conduct log analysis, and create scripts to automate analysis.

• Describe the purpose of logs, log generating events, and use of logs in relation to prevent, detect, and respond
• Describe how alerts are triggered by incidents and logs are used to correlate those incidents
• Locate network device logs and compare common data found in logs from firewalls, IDS/IPS, UTMs, and NTA, including their actual data fields
• Contrast data fields found in logs from Linux and Windows systems, including registry and other local databases
• Configure alert triggers and filters in devices and applications to avoid false positives
• Use analysis techniques with log viewers and tools to detect symptoms of phishing, DoS/DDoS, injection, hijacking, malware communication, and authentication attack events
• Use custom plugins and bash/Powershell scripting to automate large-scale analysis of log files
• Create basic Python scripts used to automate tasks and correlate relevant data

Understand the purpose and application of SIEMS, conduct analysis of SIEM results, correlate multiple network events, and detect evidence of post-attack strategies.

• Describe the purpose and application of SIEM
• Analyze SIEM results and correlate multiple events in enterprise security incidents across network devices and traffic
• Using tools like Splunk to detect evidence of post-attack strategies such as APT, lateral movement, data exfiltration, and anti-forensics

Capture live traffic and conduct analysis on captured packets for indicators of network attacks.

• Use protocol analyzers to capture live traffic on different network segments
• Filter packet capture by protocol, source, destination, and other fields
• Use analysis techniques with packet analyzers to detect symptoms of phishing, DoS/DDoS, injection, hijacking, malware communication, and authentication attack events
• Export packet captures and other analyzable reporting formats

Understand the Incident Response phases and determine indicators of compromise for given incidents.

• Given a scenario, determine which phase of incident response operation it describes, including reporting and brief templates
• Determine IOC identification, initial point of compromise identification, scoping methods and containment strategies, eradication and remediation actions for a given type of incident
• Identify incident scoping measure strategies and indicators of compromise use in incident response operations
• Given malware or adversary tools, identify methods for eradication of malware or adversary tools, and restoration and remediation activities