TN-575: Open Source Network Security Monitoring

Course Overview:

TN-575: Open Source Network Security Monitoring teaches students how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools. No network is bullet proof and when attackers access your network, this course will show you how to build a security net to detect, contain, and control the attacker. Sensitive data can be monitored and deep packet and deep attachment analysis can be achieved. As organizations stand up a Security Operations Center (SOC) the enterprise NSM is the key ingredient to that SOC. This course not only teaches how to implement an NSM technologically, but how to effectively monitor an enterprise operationally. You will learn how to architect an NSM solution: where to deploy your NSM platforms and how to size them, stand-alone or distributed, and integration into packet analysis, interpret evidence, and integrate threat intelligence from external sources to identify sophisticated attackers. A properly implemented NSM is integral to incident response and provides the responders timely information to react to the incident. TN-575: Open Source Network Security Monitoring is a lab intensive environment with a cyber range that gives each student in-depth knowledge and practical experience monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls.

Attendees to TN-575: Open Source Network Security Monitoring class will receive TechNow approved course materials and expert instruction.

This Course is taught utilizing Security Onion or RockNSM as specified by the customer.

Dates/Locations:

No Events

Duration: 5 Days

Course Objective:

The focus of this course is to present a suite of Open Source security products integrated into a highly functional and scalable Network Security Monitoring solution.

Prerequisites:

Students should have a basic understanding of networks, TCP/IP and standard protocols such as DNS, HTTP, etc. Some Linux knowledge/experience is recommended, but not required

Course Outline:

Network Security Monitoring (NSM) Methodology
High Bandwidth Packet Capture Challenges
Installation of Security Onion
- Use Cases (analysis, lab, stand-alone, distributed)
- Resource Requirements
Configuration
- Setup Phase I – Network Configuration
- Setup Phase 2 – Service Configuration
- Evaluation Mode vs. Configuration Mode
- Verifying Services
Security Onion Architecture
- Configuration Files and Folders
- Network Interfaces
- Docker Environment
- Security Onion Containers
Overview of Security Onion Analyst Tools
- Kibana
- CapME
- CyberChef
- Squert
- Sguil
- NetworkMiner
Quick Review of Wireshark and Packet Analysis
- Display and Capture Filters
- Analyze and Statistics Menu Options
- Analysis for Signatures
Analyzing Alerts
- Replaying Traffic
- 3 Primary Interfaces:
  - Squert
  - Sguil
  - Kibana
- Pivoting Between Interfaces
- Pivoting to Full Packet Capture
Snort and Surricata
- Rule Syntax and Construction
- Implementing Custom Rules
- Implementing Whitelists and Blacklists
Hunting
- Using Kibana to Slice and Dice Logs
- Hunting Workflow with Kibana
Bro
- Introduction and Overview
  - Architecture, Commands
- Understanding and Examining Bro Logs
  - Using AWK, sort, uniq, and bro-cut
- Working with traces/PCAPs
- Bro Scripts Overview
  - Loading and Using Scripts
- Bro Frameworks Overview
  - Bro File Analysis Framework FAF
- Using Bro scripts to carve out more than files
RockNSM ( * If Applicable)
- Kafka
  - Installation and Configuration
  - Kafka Messaging
  - Brokers
  - Integration with Bro and FSF
- File Scanning Framework FSF
  - Custom YARA Signatures
  - JSON Trees
  - Sub-Object Recursion
  - Bro and Suricata Integration
Elastic Stack
- Adding new data sources in Logstash
- Enriching data with Logstash
- Automating with Elastalert
- Building new Kibana dashboards
Production Deployment
- Advanced Setup
- Master vs Sensor
- Node Types – Master, Forward, Heavy, Storage
- Command Line Setup with sosetup.conf
- Architectural Recommendations
- Sensor Placement
- Hardening
- Administration
- Maintenance
Tuning
- Using PulledPork to Disable Rules
- BPF’s to Filter Traffic
- Spinning up Additional Snort / Suricata / Bro Workers to Handle Higher Traffic Loads

Comments

Latest comments from students

Liked the class? Then let everyone know!

PA-215: Palo Alto Networks Firewall Essentials FastTrack

Course Overview: PA-215: Palo Alto Networks Firewall Essentials FastTrack Training Class is a five-day course that teaches students to configure and manage the entire line of Palo Alto Networks next-generation firewalls. This course combines PA-213 and PA-212 and adds a half day introduction to Panorama and Troubleshooting. Through hands-on training, students learn high end skills of how to integrate Palo Alto next-generation firewalls into their network infrastructure. This is not a virtualized theoretical course. This is hands-on, real world instruction, directly relevant to the DoD and Commercial implementations of Palo Alto Networks next-generation firewalls.

Each student is issued a physical Palo Alto firewall and a Cisco layer 3 switch at their desk. Real hardware per student for real experience and real skill development. TechNow provides a very comprehensive client infrastructure that includes Windows, Linux, and multiple packet sniffer agents.

This course sets up the foundation for the two day course PA-232: Palo Alto Networks Panorama Manage Multiple Firewalls. The instructor for this course has been a lead in Unix kernel development to implement firewall and intrusion detection technologies. Additionally, the instructor has taught several security appliance products and carries several SANS, Cisco, Unix, and Windows certifications. Attendees to the PA-215: Palo Alto Firewall Essentials FastTrack Training Course will receive TechNow approved course materials and expert instruction.

Dates/Locations: No Events

Duration 5 days

Course Objectives: Students attending this foundational-level training course will gain an in-depth knowledge of how to configure and manage their Palo Alto Networks firewall, including hands-on experience in configuring the security, networking, threat prevention, logging, and reporting features of the Palo Alto Networks Operating System (PAN-OS). Additionally Panorama and Troubleshooting are addressed.

Day 1 Module 0 – Introduction & Overview Module 1 – Administration & Management Configuration Management PAN-OS & Software Updates Service Route Configuration Log Forwarding GUI, CLI, and API Module 2 – Interface Configuration L2 & L3 Vwire Tap Interface Management in Security Zones VLANs QoS	Day 2 Module 3 – Layer 3 Configuration L3 Configuration and DHCP NAT DNS Proxy Policy Based Forwarding in Introduction to IPv6 Module 4 – App-ID App-ID Process Policy Administration Module 5 – Content-ID Antivirus Anti-spyware Vulnerability URL Filtering File Blocking and Wildfire Data Filtering DoS Protection Botnet
Day 3 Module 6 – VM Firewall Downlaod VM Template Configure ESXi Configure VM Module 7 – Decryption SSL Inbound and Outbound Module 8 – Custom Signatures Defining New Application Signatures Application Override Custom Threat ID	Day 4 Module 9 – User-ID User-ID Agent Terminal Server Agent XML API Captive Portal Module 10 – VPN and GlobalProtect Psec Tunnels GlobalProtect Agent Portal Gateway HIP
Day 5 Module 11 – High Availability Active/Passive Active/Active Module 12 – Panorama Device Groups & Objects Shared Policy Configuration Management Reporting

Prerequisites:

Security+, Network+, CCNA and networking experience is recommended.

This course is in no way associated with Palo Alto Networks, Inc.

Comments

Latest comments from students

User: rod3535@gmail.com

Instructor comments: Instructor was great, he explained everything and made sure we understood the process's/product. He also took time out of his own schedule to help set up a VM environment on our personal pc's.

Facilities comments: Facility was great, enjoyed feeding the deers!

Like the class? Then let everyone know!

VM-345: VMware Infrastructure Security: VMware Install, Configure, and Manage with Security Objectives

Course Overview:

This course explores the VMware Infrastructure and related security, which consists of VMware ESX Server & VMware Virtual Center Server. We will look at both the design environments and operational processes of the VMware Infrastructure including security. This course provides IT architects with the insight needed to tackle tough issues in server virtualization such as virtual machine technologies, storage infrastructure, and designing clustered environments with security practices included. Extensive hands-on labs provide for a rich student experience.

Hypervisors and their supporting environment require attention to security due to the aggregated risk of hosting multiple virtual servers. This course explores the security of virtualized environments. Student configure ESXi by learning to manage the security and risk between ESXi, virtual servers and security integration of ESXi to the physical network infrastructure including appropriate segregation from other sensitive networks and management networks. How to configure virtual networks when some hosts are dual or multi homed, but internally segregate between the two or more connected networks with different security levels. Appropriate integration of zero-clients and thin clients. Configuration of defensive measures on hosts, servers, hypervisors within the virtual environment and practices for those guarding it externally. Integration of Active Directory and other AAA/CIA related services relative to a virtualized environment.

Students are also walked through DoD ESXi Security Technical Implementation Guide (STIG). Introduction to the impact of Intel Trusted Execution Technology integrated with ESXi to create a trusted platform for virtual machines. Additionally the instructor walks the students through NIST Special Publication 800-125A: Security Recommendations for Hypervisor Deployment on Servers, and NIST Special Publication 800-125B: Secure Virtual Network Configuration for Virtual Machine (VM) Protection.

Attendees to “VM-345: VMware Infrastructure Security: VMware Install, Configure, and Manage with Security Objectives” will receive TechNow approved course materials and expert instruction.

Dates/Locations:

No Events

Duration: 5 Days

Course Objectives:

• Virtual Infrastructure Overview
• ESX and ESXi Server Installation
• Configuration of Networking, Scalability and Security
• Storage
• Install and Configure vCenter Server and Components
• Creation, Deployment, Management, and Migration of Virtual Machines
• Utilize vCenter Server for Resource Management
• Utilize vCenter Server for Virtual Machine Access Control and User Managment
• Use vCenter Server to increase scalability
• Monitoring Your Environment
• Data & Availability Protection Troubleshooting
• Use VMware vCenter Update Manager to apply ESXi patches
• Use vCenter Server to manage vMotion, HA, DRS and data protection.

N-455: Securing Networks with ASA Fundamentals (SNAF)

Course Overview:

In this course, you will gain the knowledge and skills needed to configure, maintain, and operate Cisco ASA 5500 Series Adaptive Security Appliance.

Attendees to N-455: Securing Networks with ASA Fundamentals (SNAF) will receive TechNow approved course materials and expert instruction.

Dates/Locations:

No Events

Duration: 5 Days

Course Objectives:

Introducing Cisco Security Appliance Technology and Features
Cisco Adaptive Security Appliance and PIX Security Appliance Families
Getting Started with Cisco Security Appliances
Essential Security Appliance Configuration
Configuring Translations and Connection Limits
Using ACLS and Content Filtering
Configuring Object Grouping
Switching and Routing on Security Appliances
Configuring AAA for Cut-Through Proxy
Configuring the Cisco Modular Policy Framework
Configuring Advanced Protocol Handling
Configuring Threat Detection
Configuring Site-to-Site VPNS Using PreShared Keys
Configuring Security Appliance Remote Access VPNs
Configuring Cisco Security Appliance for SSL VPN
Configuring Transparent Firewalls Mode
Configuring Security Contexts
Configuring Failover
Managing Security Appliances

Prerequisites:

CCNA certification

Comments

Latest comments from students

Liked the class? Then let everyone know!

PA-213: Palo Alto Networks Firewall Install, Configure, and Manage (EDU-201)

Course Overview: PA-213: Palo Alto Networks Firewall Install, Configure, and Manage (EDU-201) Training Class is a three-day course that teaches students to configure and manage the entire line of Palo Alto Networks next-generation firewalls. This course prepares the student for the Palo Alto Networks Accredited Configuration Engineer (ACE) and progress to the Palo Alto Networks Certified Network Security Engineer (PCNSE). Through hands-on training, students learn high end skills of how to integrate Palo Alto next-generation firewalls into their network infrastructure. This is not a virtualized theoretical course. This is hands-on, real world instruction, directly relevant to the DoD and Commercial implementations of Palo Alto Networks next-generation firewalls.

Each student is issued a physical Palo Alto firewall and a Cisco layer 3 switch at their desk. Real hardware per student for real experience and real skill development. TechNow provides a very comprehensive client infrastructure that includes Windows, Linux, and multiple packet sniffer agents.

This course sets up the foundation for the two day course PA-212: Palo Alto Networks Firewall Configure Extended Features. The instructor for this course has been a lead in Unix kernel development to implement firewall and intrusion detection technologies. Additionally, the instructor has taught several security appliance products and carries several SANS, ISC2, ISACA, Cisco, Unix, and Windows certifications.

Attendees to the PA-213: Palo Alto Networks Firewall Install, Configure, and Manage (EDU-201) Training Course will receive TechNow approved course materials and expert instruction.

TechNow PA-212: Palo Alto Networks Firewall Configure Extended Features (EDU-205) immediately follows this course in the schedule so that you can take both courses in the same week. We also offer a discount for attending both classes in the same week!!

Dates/Locations: No Events

Duration: 3 days

Course Objectives: Students attending this foundational-level training course will gain an in-depth knowledge of how to configure and manage their Palo Alto Networks firewall, including hands-on experience in configuring the security, networking, threat prevention, logging, and reporting features of the Palo Alto Networks Operating System (PAN-OS).

Day 1

Module 0 – Introduction & Overview
Module 1 – Platforms and Architecture
- Single-Pass Architecture
- Flow Logic
Module 2 – Initial Configuration
- Initial Access to the System
- Configuration Management
- Licensing and Software Updates
- Account Administration
Mod 3: Basic Interface Configuration
- Security Zones
  Layer 2, Layer 3, Virtual Wire, and Tap
- Subinterfaces
- DHCP
- Virtual Routers
Mod 4: Security and NAT Policies
- Security Policy Configuration
- Policy Administration
- NAT (source and destination)

Day 2

Mod 5: Basic App-ID™
- App-ID Overview
- Application Groups and Filters
Mod 6: Basic Content-ID™
- Antivirus
- Anti-spyware
- Vulnerability
- URL Filtering
Mod 7: File Blocking and WildFire™
- File Blocking
- WildFire
Mod 8: Decryption
- Certificate Management
- Outbound SSL Decryption
- Inbound SSL Decryption

Day 3

Mod 9: Basic User-ID™
- Enumerating Users
- Mapping Users to IP Addresses
- User-ID Agent
Mod 10: Site-to-Site VPNs
- IPSec Tunnels
Mod 11: Management and Reporting
- Dashboard
- Basic Logging
- Basic Reports
- Panorama
Mod 12: Active/Passive High
- Availability
- Configuring Active/Passive HA

Prerequisites:

Security+, Network+, CCNA and networking experience is recommended.

This course is in no way associated with Palo Alto Networks, Inc.

Comments

Latest comments from students