TN-575: Open Source Network Security Monitoring

Course Overview:

TN-575: Open Source Network Security Monitoring teaches students how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools. No network is bullet proof and when attackers access your network, this course will show you how to build a security net to detect, contain, and control the attacker. Sensitive data can be monitored and deep packet and deep attachment analysis can be achieved. As organizations stand up a Security Operations Center (SOC) the enterprise NSM is the key ingredient to that SOC. This course not only teaches how to implement an NSM technologically, but how to effectively monitor an enterprise operationally. You will learn how to architect an NSM solution: where to deploy your NSM platforms and how to size them, stand-alone or distributed, and integration into packet analysis, interpret evidence, and integrate threat intelligence from external sources to identify sophisticated attackers. A properly implemented NSM is integral to incident response and provides the responders timely information to react to the incident. TN-575: Open Source Network Security Monitoring is a lab intensive environment with a cyber range that gives each student in-depth knowledge and practical experience monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls.

Attendees to TN-575: Open Source Network Security Monitoring class will receive TechNow approved course materials and expert instruction.

This Course is taught utilizing Security Onion or RockNSM as specified by the customer.

Dates/Locations:

No Events

Duration: 5 Days

Course Objective:

The focus of this course is to present a suite of Open Source security products integrated into a highly functional and scalable Network Security Monitoring solution.

Prerequisites:

Students should have a basic understanding of networks, TCP/IP and standard protocols such as DNS, HTTP, etc. Some Linux knowledge/experience is recommended, but not required

Course Outline:

Network Security Monitoring (NSM) Methodology
High Bandwidth Packet Capture Challenges
Installation of Security Onion
- Use Cases (analysis, lab, stand-alone, distributed)
- Resource Requirements
Configuration
- Setup Phase I – Network Configuration
- Setup Phase 2 – Service Configuration
- Evaluation Mode vs. Configuration Mode
- Verifying Services
Security Onion Architecture
- Configuration Files and Folders
- Network Interfaces
- Docker Environment
- Security Onion Containers
Overview of Security Onion Analyst Tools
- Kibana
- CapME
- CyberChef
- Squert
- Sguil
- NetworkMiner
Quick Review of Wireshark and Packet Analysis
- Display and Capture Filters
- Analyze and Statistics Menu Options
- Analysis for Signatures
Analyzing Alerts
- Replaying Traffic
- 3 Primary Interfaces:
  - Squert
  - Sguil
  - Kibana
- Pivoting Between Interfaces
- Pivoting to Full Packet Capture
Snort and Surricata
- Rule Syntax and Construction
- Implementing Custom Rules
- Implementing Whitelists and Blacklists
Hunting
- Using Kibana to Slice and Dice Logs
- Hunting Workflow with Kibana
Bro
- Introduction and Overview
  - Architecture, Commands
- Understanding and Examining Bro Logs
  - Using AWK, sort, uniq, and bro-cut
- Working with traces/PCAPs
- Bro Scripts Overview
  - Loading and Using Scripts
- Bro Frameworks Overview
  - Bro File Analysis Framework FAF
- Using Bro scripts to carve out more than files
RockNSM ( * If Applicable)
- Kafka
  - Installation and Configuration
  - Kafka Messaging
  - Brokers
  - Integration with Bro and FSF
- File Scanning Framework FSF
  - Custom YARA Signatures
  - JSON Trees
  - Sub-Object Recursion
  - Bro and Suricata Integration
Elastic Stack
- Adding new data sources in Logstash
- Enriching data with Logstash
- Automating with Elastalert
- Building new Kibana dashboards
Production Deployment
- Advanced Setup
- Master vs Sensor
- Node Types – Master, Forward, Heavy, Storage
- Command Line Setup with sosetup.conf
- Architectural Recommendations
- Sensor Placement
- Hardening
- Administration
- Maintenance
Tuning
- Using PulledPork to Disable Rules
- BPF’s to Filter Traffic
- Spinning up Additional Snort / Suricata / Bro Workers to Handle Higher Traffic Loads

Comments

Latest comments from students

Liked the class? Then let everyone know!

TN-415: Computer Hacking Forensics Investigator (CHFI)

Course Overview:

The Computer Hacking Forensic Investigator (CHFI) course delivers the security discipline of digital forensics from a vendor-neutral perspective. CHFI is a comprehensive course covering major forensic investigation scenarios and enabling students to acquire necessary hands-on experience with various forensic investigation techniques and standard forensic tools necessary to successfully carry out a computer forensic investigation leading to the prosecution of perpetrators.

The CHFI certification gives participants the necessary skills to perform an effective digital forensics investigation. CHRI presents a methodological approach to computer forensics including searching and seizing, chain-of-custody, acquisition, preservation, analysis and reporting of digital evidence

What’s Included:

5 days of instructor-led in classroom training
Detailed Labs for hands-on learning experience; approximately 50% of training is dedicated to labs
Hundreds of investigation tools including EnCase, Access Data FTL, & ProDiscover
Huge cache of evidence files for analysis including RAW, .dd images, video & audio files, MS Office files, systems files, etc.
CHFI Courseware
Exam Voucher
CHFI onsite exam scheduling

Course Objectives:

Establish threat intelligence and key learning points to support pro-active profiling and scenario modeling
Perform anti-forensic methods detection
Perform post-intrusion analysis of electronic and digital media to determine the who, where, what, when, and how the intrusion occurred
Extract and analyze of logs from various devices like proxy, firewall, IPS, IDS, Desktop, laptop, servers, SIM tool, router firewall, switches AD server, DHCP logs, Access Control Logs & conclude as part of investigation process
Identify & check the possible source/ incident origin
Recover deleted files and partitions in Windows, MAC OS X, and Linux
Conduct reverse engineering for known and suspected malware files
Collect data using forensic technology methods in accordance with evidence handling procedures, including collection of hard copy and electronic documents

Dates/Locations:

No Events

Duration: 5 Days

Course Content:

- Module 01. Computer Forensics in Today’s World
- Module 02. Computer Forensics Investigation Process
- Module 03. Understanding Hard Disks and File Systems
- Module 04. Data Acquisition and Duplication
- Module 05. Defeating Anti-forensics Techniques
- Module 06. Operating System Forensics (Windows, Mac, Linux)
- Module 07. Network Forensics
- Module 08. Investigating Web Attacks
- Module 09. Database Forensics
- Module 10. Cloud Forensics
- Module 10. Malware Forensics
- Module 11. Investigating Email Crimes
- Module 12. Investigating Email Crimes
- Module 13. Mobile Forensics
- Module 14. Forensics Report Writing and Presentation

Prerequisites:

- - 2+ years of proven information security work experience
  - Educational background with digital security specialization
Target Audience:
- - Law Enforcement
  - Defense & Military
  - E-Business Security
  - Systems Administrators
  - Legal Professionals
  - Banking & Insurance professionals
  - Government Agencies
  - IT Managers
Comments

Latest comments from students

Liked the class? Then let everyone know!

CL-315: CCSP – Certified Cloud Security Professional Preparation Seminar

Course Overview:

TechNow’s CCSP Certification Preparation Seminar is an accelerated course designed to meet the high demands of the information security industry by preparing students for the industry standard Certified Cloud Security Professional exam. The exam covers (ISC)²’s 6 Domains from the Common Body of Knowledge, which encompass the whole of cloud security.

This course is an intense 5 day program. TechNow has a proven training and certification track record that you can depend on. CCSP test is 125 questions that typically require more comprehension than CISSP questions. The instructor takes time to walk through scenarios that assume comprehensive knowledge of enterprise infrastructures.

Attendees to CL-315: CCSP Certification Preparation Seminar will receive TechNow approved course materials and expert instruction.

The 6 domains of the CCSP CBK:

Architectural Concepts & Design Requirements
Cloud Data Security
Cloud Platform & Infrastructure Security
Cloud Application Security
Operations
Legal & Compliance

Duration: 5 days

Audience: Mid-level to advanced professionals involved with IT architecture, web and cloud security engineering, information security, governance, risk and compliance, and even IT auditing. CCSPs will be responsible for cloud security architecture, design, operations, and/or service orchestration.

DoD 8140: Not Mandated

Course Prerequisites: IT professional with 5 years of experience, 3 years of security experience, and at least 1 year of cloud security experience. GSEC, CISSP, CASP or equivalent experience in managing enterprise infrastructures. CCSP test is 125 questions that typically require more comprehension than CISSP questions. This course is for those who are already qualified at the enterprise level for IT infrastructures, have Cloud experience, and are looking for a Cloud Security certification.

Course Objectives:

Domain 1: Architectural Concepts and Design Requirements

Module 1: Understand cloud computing concepts
Module 2: Describe cloud reference architecture
Module 3: Understand security concepts relevant to cloud computing
Module 4: Understand design principles of secure cloud computing
Module 5: Identify trusted cloud services

Domain 2: Cloud Data Security

Module 1: Understand Cloud Data Life Cycle
Module 2: Design and Implement Cloud Data Storage Architectures
Module 3: Understand and implement Data Discovery and Classification Technologies
Module 4: Design and Implement Relevant Jurisdictional Data Protection for Personally Identifiable Information (PII)
Module 5: Design and implement Data Rights Management
Module 6: Plan and Implement Data Retention, Deletion, and Archival policies
Module 7: Design and Implement Auditability, Traceability, and Accountability of Data Events

Domain 3: Cloud Platform Infrastructure Security

Module 1: Comprehend Cloud Infrastructure Comp
Module 2: Analyze Risks Associated to Cloud Infrastructure
Module 3: Design and Plan Security Controls
Module 4: Plans Disaster Recovery & Business Continuity Management

Domain 4: Cloud Application Security

Module 1: Recognize Need for Training and Awareness in Application Security
Module 2: Understand Cloud Software Assurance and Validation
Module 3: Use Verified Secure Software
Module 4: Comprehend the Software Development Life Cycle (SDLC) Process
Module 5: Apply the Secure Software Development Life Cycle
Module 6: Comprehend the Specifics of Cloud Application Architecture
Module 7: Design Appropriate Identity and Access Management (IAM) Solutions

Domain 5: Operations

Module 1: Support the Planning Process for the Data Center Design
Module 2: Implement and Build Physical Infrastructure for Cloud Environment
Module 3: Run Physical Infrastructure for Cloud Environment
Module 4: Manage Physical Infrastructure for Cloud Environment
Module 5: Build Logical Infrastructure for Cloud Environment
Module 6: Run Logical Infrastructure for Cloud Environment
Module 7: Manage Logical Infrastructure for Cloud Environment
Module 8: Ensure Compliance with Regulations and Controls
Module 9: Conduct Risk Assessment to Logical and Physical Infrastructure
Module 10: Understand the Collection and Preservation of Digital Evidence
Module 11: Manage Communications with Relevant Parties

Domain 6: Legal and Compliance

Module 1: Understand Legal Requirements and Unique Risks Within the Cloud Environment
Module 2: Understand Privacy Issues, Including Jurisdictional Variances
Module 3: Understand Audit Process, Methodologies, and Required Adaptions for a Cloud Environment
Module 4: Understand Implication of Cloud to Enterprise Risk Management
Module 5: Understand Outsourcing and Cloud Contract Design
Module 6: Execute Vendor Management

Dates/Locations:

No Events

N-425 : Implementing Cisco Enterprise Advanced Routing and Services ( ENARSI)

Course Overview:

The Implementing Cisco Enterprise Advanced Routing and Services (ENARSI) gives you the knowledge you need to install, configure, operate, and troubleshoot an enterprise network. This course covers advanced routing and infrastructure technologies, expanding on the topics covered in the N-415: Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR).

Attendees to N-425 : Implementing Cisco Enterprise Advanced Routing and Services ( ENARSI) will receive TechNow approved course materials, expert instruction, and prepare you to take the 300-410 Implementing Cisco® Enterprise Advanced Routing and Services (ENARSI) exam.

Dates/Locations:

No Events

Duration: 5 Days

Course Objectives:

Configure classic Enhanced Interior Gateway Routing Protocol (EIGRP) and named EIGRP for IPv4 and IPv6
Optimize classic EIGRP and named EIGRP for IPv4 and IPv6
Troubleshoot classic EIGRP and named EIGRP for IPv4 and IPv6
Configure Open Shortest Path First (OSPF)v2 and OSPFv3 in IPv4 and IPv6 environments
Optimize OSPFv2 and OSPFv3 behavior
Troubleshoot OSPFv2 for IPv4 and OSPFv3 for IPv4 and IPv6
Implement route redistribution using filtering mechanisms
Troubleshoot redistribution
Implement path control using Policy-Based Routing (PBR) and IP Service Level Agreement (SLA)
Configure Multiprotocol-Border Gateway Protocol (MP-BGP) in IPv4 and IPv6 environments
Optimize MP-BGP in IPv4 and IPv6 environments
Troubleshoot MP-BGP for IPv4 and IPv6
Describe the features of Multiprotocol Label Switching (MPLS)
Describe the major architectural components of an MPLS VPN
Identify the routing and packet forwarding functionalities for MPLS VPNs
Explain how packets are forwarded in an MPLS VPN environment
Implement Cisco Internetwork Operating System (IOS®) Dynamic Multipoint VPNs (DMVPNs)
Implement Dynamic Host Configuration Protocol (DHCP)
Describe the tools available to secure the IPV6 first hop
Troubleshoot Cisco router security features
Troubleshoot infrastructure security and services

Prerequisites:

CCNA certification
N-415: Implementing and Operating Cisco Enterprise Network Core Technologies
General understanding of network fundamentals
Basic knowledge of how to implement LANs
General understanding of how to manage network devices
General understanding of how to secure network devices
Basic knowledge of network automation

Comments

Latest comments from students

Liked the class? Then let everyone know!

CT-325: Security+

Course Overview:

The CT-325: Security+ (SY0-701) class is the primary class you will need to take if your job responsibilities include securing network services, network devices, and network traffic. It will also help you prepare for the CompTIA Security+ examination (exam number SY0-701). In the CT-325: Security+ class you’ll build on your knowledge and professional experience with computer hardware, operating systems, and networks as you acquire the specific skills required to implement basic security services on any type of computer network. Let us help you prepare for the CompTIA Security+ exam (SY0-701).

TechNow is a CompTIA partner and uses official CompTIA Security+ curriculum.

Attendees to CT-325: Security+ will receive TechNow approved course materials and TechNow expert instruction.

Dates/Locations:

Date/Time	Event
08/18/2025 - 08/22/2025 08:00 -16:00	CT-325: Security+ TechNow, Inc, San Antonio TX
10/27/2025 - 10/31/2025 08:00 -20:00	CT-325: Security+ TechNow, Inc, San Antonio TX
12/15/2025 - 12/19/2025 08:00 -16:00	CT-325: Security+ TechNow, Inc, San Antonio TX

Duration: 5 Days

Course Objectives:

Compare and contrast attacks
Compare and contrast security controls
Use security assessment tools
Explain basic cryptography concepts
Implement a public key infrastructure
Implement identity and access management controls
Manage access services and accounts
Implement a secure network architecture
Install and configure security appliances
Install and configure wireless and physical access security
Deploy secure host, mobile, and embedded systems
Implement secure network access protocols
Implement secure network applications
Explain risk management and disaster recovery concepts
Describe secure application development concepts
Explain organizational security concepts

Prerequisites:

CompTIA A+ and Network+ certifications, or equivalent knowledge.
Windows 7/8/10 and Server 2008/2012/2016 experience required.
Six to nine months experience in networking, including experience in configuring & managing TCP/IP.

Comments

Latest comments from students

User: joshjepsen@hotmail.com

Instructor comments: Instructor was very knowledgeable on all the course content. There were some instances when I felt he streamlined through some of the material too quickly, such as going over how to identify types of attacks.