Security Event Triage: Detecting System Anomalies from Pluralsight

In this course on system anomaly detection, you will explore the use of CPU, RAM, GPU, fans, and power resource usage data to reveal various advanced attacker techniques and uncover events associated with hardware supply chain interdiction.

Developing the skills necessary for a security analyst to properly detect and triage advanced attacker intrusion tactics and techniques requires experience and the use of advanced detection capabilities. Neither of which are easily obtained. In this course, Security Event Triage: Detecting System Anomalies, you will learn foundational knowledge required to baseline different machine performance data and triage deviations from that baseline that can indicate a stealthy adversary’s presence in your environment when all other methods have failed. First, you will learn about CPU, RAM, and Hard drive metric data and how it can be used to detect anything from botnets to the use of hard drives as microphones for side-channel espionage. Next, you will discover the techniques used for “in-browser” crypto-jacking or malware delivered crypto mining activity by monitoring browser activity and GPU usage that stands out from the established baseline for normal applications. Finally, you will look at fan speeds and power usage to identify air-gapped network hopping techniques and hardware supply chain compromise. When you are finished with this course, you will have the skills and knowledge of not only how a multitude of advanced attacker techniques are performed, but also what they look like in a realistic environment and how to identify them as part of your security analyst operations.

What's inside

Syllabus

Course Overview

Introduction to System Telemetry Analysis

Analyzing the Computing Basics

Leveraging Graphics Processing Indicators

Uncovering Significance of Power and Fans, Lights

Incorporating Telemetry Analysis in Triage Workflow

Good to know

Know what's good

, what to watch for

, and possible dealbreakers

Explores system anomaly detection using CPU, RAM, GPU, fans, and power resource usage data, providing foundational knowledge for security analysts

Covers advanced attacker tactics and techniques, including botnets, crypto-jacking, side-channel espionage, and hardware supply chain compromise

Teaches skills and knowledge necessary for triage and detection of advanced attacker intrusion tactics and techniques through baseline analysis and deviation detection

Helps security analysts develop the experience and capabilities to identify stealthy adversaries and protect their environments

Provides hands-on labs and interactive materials to reinforce learning and develop practical skills

Activities

Be better prepared before your course. Deepen your understanding during and after it. Supplement your coursework and achieve mastery of the topics covered in Security Event Triage: Detecting System Anomalies with these activities:

System Telemetry Analysis Concepts Refresher

Show steps

This course includes monitoring and analyzing system data, so reviewing general system telemetry analysis concepts and techniques will be beneficial.

Show steps

Review documentation or online resources on system telemetry analysis concepts
Practice analyzing sample system telemetry data

Compilation of Tools for Telemetry Analysis and Threat Detection

Show steps

Having a collection of useful tools at your disposal is crucial for effective system anomaly detection. Compile a list of tools for telemetry analysis, threat detection, and security monitoring.

Browse courses on Cybersecurity Tools

Show steps

Research and identify tools that align with the course objectives.
Categorize and organize the tools based on their functionality and relevance.

Workshop on Leveraging Fan Speeds and Power Usage for Threat Detection

Show steps

Explore advanced techniques for identifying hardware supply chain compromises and air-gapped network hopping by monitoring fan speeds and power usage. Attend a workshop to gain hands-on experience.

Show steps

Identify and register for a relevant workshop.
Attend the workshop and actively participate in the exercises.

Three other activities

Expand to see all activities and additional details

Show all six activities

Practice Detecting Anomalies with CPU Metrics

Show steps

Understanding how to detect anomalies in CPU metrics is essential for identifying advanced attacker techniques. Engage in practice drills to enhance your ability to analyze CPU data for threat detection.

Show steps

Find datasets or generate sample CPU metrics data with known anomalies.
Use data analysis tools to analyze CPU metrics and identify deviations from normal patterns.

Deliverable: Incident Response Plan for System Telemetry Anomalies

Show steps

To ensure effective handling of security incidents, it's crucial to have a well-defined incident response plan. Create a deliverable that outlines your incident response process for system telemetry anomalies.

Browse courses on Incident Response Planning

Show steps

Identify potential security incidents related to system telemetry anomalies.
Develop a step-by-step incident response plan, including roles and responsibilities.

Project: Develop a System Telemetry Monitoring Dashboard

Show steps

To effectively monitor and analyze system telemetry data, it's beneficial to create a customized dashboard. Start a project to develop a dashboard that meets your specific security requirements.

Show steps

Define the scope and requirements of the dashboard.
Choose appropriate data visualization tools and techniques.

Career center

Learners who complete Security Event Triage: Detecting System Anomalies will develop knowledge and skills that may be useful to these careers:

Security Engineer

Security Engineers are responsible for designing and implementing security systems and solutions. They use a variety of tools and techniques to protect systems from threats, including system anomaly detection. This course can help Security Engineers to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Security Engineer

Security Analyst

Security Analysts are responsible for investigating and resolving security incidents. They use a variety of tools and techniques to detect and respond to threats, including system anomaly detection. This course can help Security Analysts to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Security Analyst

Cybersecurity Analyst

Cybersecurity Analysts are responsible for analyzing security data and identifying threats. They use a variety of tools and techniques to detect and respond to threats, including system anomaly detection. This course can help Cybersecurity Analysts to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Cybersecurity Analyst

Security Consultant

Security Consultants are responsible for providing advice and guidance on security matters. They use a variety of tools and techniques to assess security risks and develop security solutions. This course can help Security Consultants to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Security Consultant

Incident Responder

Incident Responders are responsible for responding to security incidents and restoring systems to normal operation. They use a variety of tools and techniques to investigate and resolve incidents, including system anomaly detection. This course can help Incident Responders to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Incident Responder

Penetration Tester

Penetration Testers are responsible for simulating attacks on systems to identify vulnerabilities. They use a variety of tools and techniques to identify and exploit vulnerabilities. This course can help Penetration Testers to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Penetration Tester

Malware Analyst

Malware Analysts are responsible for analyzing malware and identifying its functionality. They use a variety of tools and techniques to analyze malware and develop detection and mitigation strategies. This course can help Malware Analysts to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Malware Analyst

Information Security Manager

Information Security Managers are responsible for managing the security of an organization's information systems. They use a variety of tools and techniques to assess security risks and develop security solutions. This course can help Information Security Managers to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Information Security Manager

Chief Information Security Officer (CISO)

CISOs are responsible for overseeing the security of an organization's information systems. They use a variety of tools and techniques to assess security risks and develop security solutions. This course can help CISOs to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Chief Information Security Officer (CISO)

Data Protection Officer (DPO)

DPOs are responsible for ensuring that an organization complies with data protection laws and regulations. They use a variety of tools and techniques to assess data protection risks and develop data protection solutions. This course can help DPOs to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Data Protection Officer (DPO)

Forensic Investigator

Forensic Investigators are responsible for investigating security incidents and collecting evidence. They use a variety of tools and techniques to analyze evidence and identify the source of an attack. This course can help Forensic Investigators to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Forensic Investigator

Threat Intelligence Analyst

Threat Intelligence Analysts are responsible for collecting and analyzing threat intelligence. They use a variety of tools and techniques to identify and track threats. This course can help Threat Intelligence Analysts to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Threat Intelligence Analyst

IT Security Manager

IT Security Managers are responsible for managing the security of an organization's IT systems. They use a variety of tools and techniques to assess security risks and develop security solutions. This course can help IT Security Managers to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for IT Security Manager

Vulnerability Researcher

Vulnerability Researchers are responsible for finding and exploiting vulnerabilities in software and systems. They use a variety of tools and techniques to identify and exploit vulnerabilities. This course can help Vulnerability Researchers to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Vulnerability Researcher

Privacy Manager

Privacy Managers are responsible for managing the privacy of an organization's data. They use a variety of tools and techniques to assess privacy risks and develop privacy solutions. This course can help Privacy Managers to develop the skills they need to detect and triage advanced attacker intrusion tactics and techniques.

See salaries and explore the career path for Privacy Manager