TN-905: Cyber Threat Intelligence Analysis

 

Course Overview:

TechNow has worked worldwide enterprise infrastructures for over 30 years and has developed demos and labs to exemplify the techniques required to demonstrate technologies that effectively support CTI.  This course integrates well with our courses TN-575: Open Source Network Security Monitoring and TN-865: Wireshark Network Traffic and Security Analysis .

TechNow develops Cyber Ranges and makes them available for conferences in support of annual meetings for Cyber Threat Response Teams.  Developing scenarios and reacting to them appropriately is a big part of the value in understanding the contexts required to comprehend valuable CTI.   As with many advanced TechNow security courses, there is a large hands-on ratio.  This course helps Cyber Protection Teams (CPT), Defensive Cyber Operations (DCO), and Mission Defense Teams (MDT) to collect, analyze and apply targeted cyber intelligence to defensive operations in order to proactively act on and tune response to attacks by cyber adversaries.  CPT, DCO, and MDT can take preemptive action by utilizing CTI, understanding CTI tools, techniques and procedures (TTPs) needed to generate and consume timely and relevant intelligence to improve resilience and prevention.

This course focuses on the collection, classification, and exploitation of knowledge about adversaries and their TTPs. .  MDT puts us close the mission and helps define the internal context to be analyzed against the CTI.  TechNow pushes the student to truly understand how to think about and use CTI to make a difference.

Attendees to TN-905: Cyber Threat Intelligence Analysis will receive TechNow approved course materials and expert instruction.

Date/Locations:

No Events

Course Duration: 5 days

Course Objectives:

  • Learn to comprehend and develop complex scenarios
  • Identify and create intelligence requirements through practices such as threat modeling
  • Utilize threat modeling to drive intelligence handling and practices 
  • Breakdown tactical, operational, and strategic-level threat intelligence
  • Generate threat intelligence to detect, respond to, and defeat focused and targeted threats
  • How to collect adversary information creating better value CTI
  • How to filter and qualify external sources, mitigating low integrity intelligence
  • Create Indicators of Compromise (IOCs) in formats such as YARA, OpenIOC, and STIX
  • Move security maturity past IOCs into understanding and countering the behavioral tradecraft of threats
  • Breaking down threats mapped against their tradecraft to tweak IOCs
  • Establish structured analytical techniques to be successful in any security role
  • Learn and apply structured principles in support of CTI and how to communicate that to any security role.

Course Prerequisites:

Comments

Latest comments from students

 

Liked the class?  Then let everyone know!

cheddarcon-powershell-threat-hunting-registration

    After you press "Request Registration" near the bottom of this form, within 30 seconds, status will be provided at the bottom of the form, you will also be contacted by phone for credit card information.

    Tech Now is pleased to have the opportunity to provide you training for "Windows Security Automation and Threat Hunting with PowerShell” at CheddarCon 2018!

    Scroll down to see the course description.

    First Name*

    Last Name*

    Your Email*

    Your Organization*

    Phone*

    Questions:

    After you press "Request Registration" on this form, within 30 seconds, status will be provided at the bottom of the form, you will also be contacted by phone for credit card information.

    Windows Security Automation and Threat Hunting with PowerShell Seminar

    Location: 400 W Wisconsin Ave, Milwaukee, WI 53203, USA

    Date: October 10, 2018 8:00am – 4:00pm

    Duration: 8 hours

    Audience: Cyber Security professionals and Windows administrators

    Attendees Environment: Laptops not required, but suggested to have better hands-on absorption of subject matter.

    Description:
    PowerShell is both a command-line shell and scripting language. Fight fires quickly using existing or custom PowerShell commands or scripts at the shell. PowerShell is made for Security Operations (SecOps) automation on Windows. This seminar does not require prior programming skills. The seminar focuses on PowerShell programming, giving a beginner skills to be productive in windows scripting to automate tasks and also remediate problems.

    Cyber Security is the objective of this seminar, and the PowerShell examples will demonstrate PowerShell capabilities that help lock down a Windows system and also report security status.

    Objectives:

    PowerShell Overview

    • Getting started running commands
    • Security cmdlets
    • Using and updating the built-in help
    • Execution policies
    • Fun tricks with the ISE graphical editor
    • Piping .NET and COM objects, not text
    • Using properties and methods of objects
    • Helping Linux admins feel more at home
    • Aliases, cmdlets, functions, modules, etc.

    PowerShell Utilities and Tips

    • Customizing your profile script
    • PowerShell remote command execution
    • Security setting across the network
    • File copy via PowerShell remoting
    • Capturing the output of commands
    • Parsing text files and logs with regex patterns
    • Parsing Security Logs
    • Searching remote event logs
    • Mounting the registry as a drive
    • Security settings in the Registry
    • Exporting data to CSV, HTML and JSON files
    • Running scripts as scheduled jobs
    • Continued Security Compliance
    • Pushing out scripts through Group Policy
    • Importing modules and dot-sourcing functions
    • http://www.PowerShellGallery.com

    PowerShell Scripting

    • PowerShell Scripting to implement Security Practices
    • Writing your own functions to automate security status and settings
    • Passing arguments into your scripts
    • Function parameters and returning output
    • Flow control: if-then, foreach, that make security decisions
    • How to pipe data in/out of your scripts for security compliance and reporting

    Attendees to this seminar, Windows Security Automation and Threat Hunting with PowerShell, will receive TechNow approved course materials and expert instruction.[/wr_text][/wr_column][/wr_row]

    TN-575: Open Source Network Security Monitoring

     

    Course Overview:

    TN-575: Open Source Network Security Monitoring teaches students how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools. No network is bullet proof and when attackers access your network, this course will show you how to build a security net to detect, contain, and control the attacker. Sensitive data can be monitored and deep packet and deep attachment analysis can be achieved. As organizations stand up a Security Operations Center (SOC) the enterprise NSM is the key ingredient to that SOC. This course not only teaches how to implement an NSM technologically, but how to effectively monitor an enterprise operationally. You will learn how to architect an NSM solution: where to deploy your NSM platforms and how to size them, stand-alone or distributed, and integration into packet analysis, interpret evidence, and integrate threat intelligence from external sources to identify sophisticated attackers. A properly implemented NSM is integral to incident response and provides the responders timely information to react to the incident. TN-575: Open Source Network Security Monitoring is a lab intensive environment with a cyber range that gives each student in-depth knowledge and practical experience monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls.

    Attendees to TN-575: Open Source Network Security Monitoring class will receive TechNow approved course materials and expert instruction.

    This Course is taught utilizing Security Onion or RockNSM as specified by the customer.

    Dates/Locations:

    No Events

    Duration: 5 Days

    Course Objective:

    The focus of this course is to present a suite of Open Source security products integrated into a highly functional and scalable Network Security Monitoring solution.

    Prerequisites:

    Students should have a basic understanding of networks, TCP/IP and standard protocols such as DNS, HTTP, etc. Some Linux knowledge/experience is recommended, but not required

    Course Outline:

    • Network Security Monitoring (NSM) Methodology
    • High Bandwidth Packet Capture Challenges
    • Installation of Security Onion
      • Use Cases (analysis, lab, stand-alone, distributed)
      • Resource Requirements
    • Configuration
      • Setup Phase I – Network Configuration
      • Setup Phase 2 – Service Configuration
      • Evaluation Mode vs. Configuration Mode
      • Verifying Services
    • Security Onion Architecture
      • Configuration Files and Folders
      • Network Interfaces
      • Docker Environment
      • Security Onion Containers
    • Overview of Security Onion Analyst Tools
      • Kibana
      • CapME
      • CyberChef
      • Squert
      • Sguil
      • NetworkMiner
    • Quick Review of Wireshark and Packet Analysis
      • Display and Capture Filters
      • Analyze and Statistics Menu Options
      • Analysis for Signatures
    • Analyzing Alerts
      • Replaying Traffic
      • 3 Primary Interfaces:
        • Squert
        • Sguil
        • Kibana
      • Pivoting Between Interfaces
      • Pivoting to Full Packet Capture
    • Snort and Surricata
      • Rule Syntax and Construction
      • Implementing Custom Rules
      • Implementing Whitelists and Blacklists
    • Hunting
      • Using Kibana to Slice and Dice Logs
      • Hunting Workflow with Kibana
    • Bro
      • Introduction and Overview
        • Architecture, Commands
      • Understanding and Examining Bro Logs
        • Using AWK, sort, uniq, and bro-cut
      • Working with traces/PCAPs
      • Bro Scripts Overview
        • Loading and Using Scripts
      • Bro Frameworks Overview
        • Bro File Analysis Framework FAF
      • Using Bro scripts to carve out more than files
    • RockNSM ( * If Applicable)
      •  Kafka
        • Installation and Configuration
        • Kafka Messaging
        • Brokers
        • Integration with Bro and FSF
      • File Scanning Framework FSF
        • Custom YARA Signatures
        • JSON Trees
        • Sub-Object Recursion
        • Bro and Suricata Integration
    • Elastic Stack
      • Adding new data sources in Logstash
      • Enriching data with Logstash
      • Automating with Elastalert
      • Building new Kibana dashboards
    • Production Deployment
      • Advanced Setup
      • Master vs Sensor
      • Node Types – Master, Forward, Heavy, Storage
      • Command Line Setup with sosetup.conf
      • Architectural Recommendations
      • Sensor Placement
      • Hardening
      • Administration
      • Maintenance
    • Tuning
      • Using PulledPork to Disable Rules
      • BPF’s to Filter Traffic
      • Spinning up Additional Snort / Suricata / Bro Workers to Handle Higher Traffic Loads

    Comments

    Latest comments from students

     

    Liked the class?  Then let everyone know!

    TN-305: Designing, Implementing, Administering and Securing Wireless Local Area Networks (LANs)

    Course Overview:

    This course, TN-305: Designing, Implementing, Administering and Securing Wireless Local Area Networks (LANs), covers the two main objectives for those entering the wireless world, understanding the technology & addressing its security.  TN-305: Designing, Implementing, Administering and Securing Wireless Local Area Networks (LANs) takes advantage of the student’s existing expertise to provide a challenging introductory course. Covering a broad range of wireless networking topics & an introduction on how to secure a wireless LAN from hackers. To insure wireless availability you need to understand proper design choices & administration practices. To protect valuable information on your network you need to know how attacks occur & techniques used to secure your wireless network.

    Attendees to TN-305: Designing, Implementing, Administering and Securing Wireless Local Area Networks (LANs) will receive TechNow approved course materials and expert instruction.

    Dates/Locations:

    No Events

    Duration: 5 Days

    Course Objectives:

    • Radio Frequency (RF) Fundamentals
    • Spread Spectrum Technologies
    • 802.11 Network Architecture
    • Physical & MAC Layers
    • Hardware Installation, Configuration, & Management
    • Antennas & Accessories
    • Wireless Network Management
    • Troubleshooting Wireless LANs
    • Site Surveying
    • Wireless LAN Security
    • Organizations & Standards

    Prerequisites:

    Attendees should have network administration skills.  These skills can be obtained through TechNow’s N-205 & N-305: CCNA/ICND Training program or our highly respected cross platform TN-385: TCP/IP Analysis & Implementation course.

    Comments

    Latest comments from students

    User: TMPRIESTLEY

    Instructor comments: The instructor was very well versed on the topic and knew how to apply it to real-life examples. He led the labs and was very excited about the topic which kept the interest of myself and other class members. Sometimes his volume level was a little high- however the room the class was in was very small. Too small for a big personality!

    Facilities comments: I was unaware of the facility changes, but that was at no fault of anyone since I was a drop-in for the course. They were very helpful and quick to mediate the issue.

    Liked the class?  Then let everyone know!

    CL-415: AWS System Operations

    Course Overview:

    AWS System Operations begins with a one day  introduction to AWS products, services, and common solutions. It provides you with fundamentals to become more proficient in identifying AWS services so that you can make informed decisions about IT solutions based on your business requirements and get started working on AWS.

    The AWS course continues to flow with teaching those in a Systems Administrator or Developer Operations (DevOps) role how to create automatable and repeatable deployments of networks and systems on the AWS platform. The course covers the specific AWS features and tools related to configuration and deployment, as well as common techniques used throughout the industry for configuring and deploying systems.

    To continue to learn more about AWS, TechNow has the following course:

    CL-425: AWS Security Operations and Architecture 

    Attendees to CL-415: AWS System Operations will receive TechNow approved course materials and expert instruction.

    Duration: 5 Days

    Audience:
    This course is intended for:
    • System Administrators
    • Software Developers, especially those in a Developer Operations (DevOps) role

    DoD 8140: Not Mandated

    Course Prerequisites:
    We recommend that attendees of this course have the following prerequisites:
    • Background in either software development or systems administration
    • Some experience with maintaining operating systems at the command line (shell scripting in Linux environments, cmd or PowerShell in Windows)
    • Basic knowledge of networking protocols (TCP/IP, HTTP)

    Course Objectives:
    This course is designed to teach you how to:
    • Understand basic data center design concepts.
    • Recognize terminology and concepts as they relate to the AWS platform and navigate the AWS Management Console.
    • Understand the foundational infrastructure services, including Amazon Virtual Private Cloud (VPC), Amazon Elastic Compute Cloud (EC2), Amazon Elastic Block Store (EBS), Amazon Simple Storage Service (S3), Auto Scaling, and Elastic Load Balancing (ELB).
    • Understand the security measures AWS provides and key concepts of AWS Identity and Access Management (IAM).
    • Understand AWS database services, including Amazon DynamoDB and Amazon Relational Database Service (RDS).
    • Understand AWS management tools, including Amazon CloudWatch and AWS Trusted Advisor.
    • Use standard AWS infrastructure features such as Amazon Virtual Private Cloud (VPC), Amazon Elastic Compute Cloud (EC2), Elastic Load Balancing, and Auto Scaling from the command line
    • Use AWS CloudFormation and other automation technologies to produce stacks of AWS resources that can be deployed in an automated, repeatable fashion
    • Build functioning virtual private networks with Amazon VPC from the ground up using the AWS Management Console
    • Deploy Amazon EC2 instances using command line calls and troubleshoot the most common problems with instances
    • Monitor the health of Amazon EC2 instances and other AWS services
    • Manage user identity, AWS permissions, and security in the cloud
    • Manage resource consumption in an AWS account using tools such as Amazon CloudWatch, tagging, and Trusted Advisor
    • Select and implement the best strategy for creating reusable Amazon EC2 instances
    • Configure a set of Amazon EC2 instances that launch behind a load balancer, with the system scaling up and down in response to demand
    • Edit and troubleshoot a basic AWS CloudFormation stack definition

    Dates/Locations:

    No Events

    Course Outline:

    Day 1

    • Introduction and History of AWS
    • AWS Infrastructure: Compute, Storage, and Networking
    • AWS Security, Identity, and Access Management
    • AWS Databases
    • AWS Management Tools

    Day 2
    • System Operations on AWS Overview
    • Networking in the Cloud
    • Computing in the Cloud
    Day 3
    • Storage and Archiving in the Cloud
    • Monitoring in the Cloud
    • Managing Resource Consumption in the Cloud
    Day 4
    • Configuration Management in the Cloud
    • Creating Scalable Deployments in the Cloud
    • Creating Automated and Repeatable Deployments
    Day 5
    Full Day Lab
    • Select the appropriate AWS service based on compute, data, or security requirements
    • Execute steps required to provision cloud resources for selected deployment
    • Identify and implement data protection, encryption, and capacity planning
    • Implement and manage security policies, access controls, and role
    • Implement Automation

     

    Next/Related Courses: