Threat Investigation

What's inside

Syllabus

Identifying Resources for Hunting Cyber Threats

If you are an associate-level cybersecurity analyst who is working in security operation centers, this course will help you understand how threat-centric SOC must prepare for analyzing new and emerging threats by implementing robust security investigation procedures • By the end of the course, you will be able to: • Understand cyber-threat hunting concepts • Describe the five hunting maturity levels (HM0–HM4) • Describe the hunting cycle four-stage loop• Describe the use of the Common Vulnerability Scoring System (CVSS) and list the CVSS v3.0 base metrics• Describe the CVSS v3.0 scoring components (base, temporal, and environmental) • Provide an example of CVSS v3.0 scoring • Describe the use of a hot threat dashboard within a SOC • Provide examples of publicly available threat awareness resources • Provide examples of publicly available external threat intelligence sources and feeds• Describe the use of security intelligence feed • Describe threat analytics systems • Describe online security research tools • Simulate malicious actions to populate the event data on the Security Onion tools for later analysis • Identify resources for hunting cyber threats. To be successful in this course, you should have the following background: 1. Skills and knowledge equivalent to those learned in Implementing and Administering Cisco Solutions (CCNA) v1.0 course 2. Familiarity with Ethernet and TCP/IP networking 3. Working knowledge of the Windows and Linux operating systems 4. Familiarity with basics of networking security concepts.

Traffic lights

Read about what's good

what should give you pause

and possible dealbreakers

Builds a strong foundation for beginners in Threat Hunting analysis and investigation

Explores industry-standard practices and techniques for Threat Hunting, making it highly relevant in the field

Taught by Cisco Learning & Certifications, recognized for their work in networking and Cybersecurity

Covers unique perspectives and ideas that may add color to other cybersecurity topics

Requires working knowledge of Windows and Linux operating systems, which may be a barrier for some learners

Assumes learners have familiarity with basics of networking security concepts, which may not be suitable for absolute beginners

Reviews summary

Threat investigation: foundational soc skills

According to learners, this course provides a strong foundational understanding for associate-level cybersecurity analysts in Security Operation Centers. Many students find the practical, hands-on labs, particularly with Security Onion, to be highly relevant and applicable to real-world SOC roles. While the course is praised for its clear structure and digestible content, some learners feel that the depth of coverage can be inconsistent or that the material is too introductory for those with more experience. There's also a divergence in opinion regarding the timeliness of tools and examples, with some finding them current and others perceiving them as dated.

Views vary on whether the tools and content are up-to-date.

"Some of the tools and examples felt a little outdated for modern SOC environments; I wish they were more current."

"While the core concepts are valuable, I think the course could benefit from updating its specific tool versions and examples."

"I found the Security Onion labs to be very practical and relevant, despite hearing some opinions about certain tools being less cutting-edge."

Concepts are presented clearly and in a logical manner.

"The instructor presented the material very clearly, making complex topics easy to understand and follow."

"I found the course structure to be logical and well-organized, which greatly aided my learning process."

"The explanations for event correlation and threat hunting were straightforward and concise, highly appreciated."

An excellent starting point for new and junior SOC analysts.

"This course was exactly what I needed as someone new to cybersecurity, providing a solid foundational understanding."

"As an associate-level analyst, I feel this course fills a crucial gap in my knowledge and prepares me for the field."

"I've gained a comprehensive foundation in threat investigation, making me feel more equipped for my role."

Hands-on exercises offer invaluable real-world application.

"The hands-on labs provided were truly insightful, offering practical knowledge that I can apply directly in my day-to-day SOC tasks."

"I found the practical exercises on Security Onion to be the most beneficial part of the course; they cemented my understanding."

"The labs give me a solid foundation and confidence to tackle real-world threat investigations, making the learning very concrete."

Some learners desire more advanced or consistent depth.

"While good for an overview, I found myself wanting more in-depth coverage on certain advanced threat scenarios."

"The course content felt a bit introductory in some modules; I was expecting a more advanced level of detail."

"For someone with some prior experience, the course occasionally felt too basic and didn't challenge me enough."

Activities

Be better prepared before your course. Deepen your understanding during and after it. Supplement your coursework and achieve mastery of the topics covered in Threat Investigation with these activities:

Security Practice Drills

Show steps

Establish the foundation for security incident investigations.

Browse courses on Cybersecurity

Show steps

Identify and understand basic security techniques used in network security monitoring.
Practice identifying evidence of a security incident.
Develop skills in correlating and normalizing security events.
Prepare for advanced persistent threat (APT) analysis.

Cybersecurity Playbook Development

Show steps

Enhance your understanding of playbook development and incident response.

Browse courses on Security Playbooks

Show steps

Create a cybersecurity playbook for your organization.
Identify the incident response procedures for your organization.
Develop a plan for testing and maintaining the playbook.

SOC Program Design

Show steps

Enhance understanding of SOC operations and threat hunting strategies.

Browse courses on Threat Hunting

Show steps

Attend a workshop on SOC program design.
Learn about different types of SOCs and their functions.
Develop a plan for implementing a SOC program.
Identify and evaluate threat hunting tools and techniques.

One other activity

Expand to see all activities and additional details

Show all four activities

Open-Source Threat Intelligence Analysis

Show steps

Gain experience in gathering and analyzing threat intelligence from open sources.

Show steps

Identify and utilize reputable open-source threat intelligence feeds.
Develop a process for collecting, filtering, and analyzing threat intelligence data.
Share and collaborate on threat intelligence findings with the community.

Career center

Learners who complete Threat Investigation will develop knowledge and skills that may be useful to these careers:

Threat Hunter

Threat Hunters proactively search for and identify threats to an organization's security. This course may be useful in preparing you for this role by teaching you about threat hunting concepts, security intelligence feeds, and online security research tools.

See salaries and explore the career path for Threat Hunter

Chief Information Security Officer (CISO)

CISOs are responsible for the overall security of an organization's information systems. This course may be useful in preparing you for this role by teaching you about threat hunting, risk management, and security analytics.

See salaries and explore the career path for Chief Information Security Officer (CISO)

Cybersecurity Engineer

Cybersecurity Engineers design, implement, and maintain security measures to protect an organization's networks and computer systems. This course may be useful by teaching you about network security monitoring, event correlation, and security incident investigations.

See salaries and explore the career path for Cybersecurity Engineer

Security Engineer

Security Engineers design, implement, and maintain security controls to protect an organization's networks and computer systems. This course may be useful in preparing you for this role by teaching you about network security monitoring, event correlation, and security incident investigations.

See salaries and explore the career path for Security Engineer

Security Architect

Security Architects design and implement security solutions for an organization's computer systems and networks. This course may be useful by teaching you about threat hunting, risk management, and security analytics.

See salaries and explore the career path for Security Architect

SOC Analyst

SOC Analysts monitor an organization's security systems for suspicious activity and investigate security incidents. This course may help prepare you for this role by teaching you about threat hunting, CVSS scoring, and security analytics.

See salaries and explore the career path for SOC Analyst

Information Security Analyst

Information Security Analysts design, implement, and manage security measures to protect an organization's information systems. This course may help you prepare for this role by teaching you about threat hunting, CVSS scoring, and security analytics.

See salaries and explore the career path for Information Security Analyst

Security Operations Manager

Security Operations Managers oversee the day-to-day operations of an organization's security program. This course may be useful by teaching you about threat hunting, risk management, and security incident investigations.

See salaries and explore the career path for Security Operations Manager

Information Security Manager

Information Security Managers oversee the development and implementation of an organization's information security program. This course may be useful by teaching you about threat hunting, risk management, and security incident investigations.

See salaries and explore the career path for Information Security Manager

Security Consultant

Security Consultants provide advice and guidance to organizations on how to improve their security posture. This course may be useful in preparing you for this role by teaching you about threat hunting, risk management, and security incident investigations.

See salaries and explore the career path for Security Consultant

Digital Forensic Analyst

Digital Forensic Analysts investigate computer systems and networks to find evidence of criminal activity. This course may be useful in preparing you for this role by teaching you about event correlation, security incident investigations, and online security research tools.

See salaries and explore the career path for Digital Forensic Analyst

Cybersecurity Analyst

Cybersecurity Analysts plan and implement security measures to protect an organization's computer systems and networks. This course may help prepare you for this role by teaching you about network security monitoring, event correlation, and security incident investigations.

See salaries and explore the career path for Cybersecurity Analyst

Threat Intelligence Analyst

Threat Intelligence Analysts research and analyze potential threats to an organization's security. They also provide recommendations on how to mitigate these threats. By teaching you about threat-centric SOCs and threat intelligence feeds, this course may be useful in preparing you for this role.

See salaries and explore the career path for Threat Intelligence Analyst

Security Analyst

Security Analysts monitor networks for suspicious activity and investigate security breaches. This course may be useful in preparing you for this career by teaching you about threat hunting concepts, security intelligence feeds, and online security research tools.

See salaries and explore the career path for Security Analyst

Incident Responder

Incident Responders track down the source of security breaches after a network has already been compromised. They also take action to prevent further damage. This course may help prepare you for this role by teaching you how to identify and investigate security incidents.

See salaries and explore the career path for Incident Responder