TN-575: Open Source Network Security Monitoring

 

Course Overview:

TN-575: Open Source Network Security Monitoring teaches students how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools. No network is bullet proof and when attackers access your network, this course will show you how to build a security net to detect, contain, and control the attacker. Sensitive data can be monitored and deep packet and deep attachment analysis can be achieved. As organizations stand up a Security Operations Center (SOC) the enterprise NSM is the key ingredient to that SOC. This course not only teaches how to implement an NSM technologically, but how to effectively monitor an enterprise operationally. You will learn how to architect an NSM solution: where to deploy your NSM platforms and how to size them, stand-alone or distributed, and integration into packet analysis, interpret evidence, and integrate threat intelligence from external sources to identify sophisticated attackers. A properly implemented NSM is integral to incident response and provides the responders timely information to react to the incident. TN-575: Open Source Network Security Monitoring is a lab intensive environment with a cyber range that gives each student in-depth knowledge and practical experience monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls.

Attendees to TN-575: Open Source Network Security Monitoring class will receive TechNow approved course materials and expert instruction.

This Course is taught utilizing Security Onion or RockNSM as specified by the customer.

Dates/Locations:

No Events

Duration: 5 Days

Course Objective:

The focus of this course is to present a suite of Open Source security products integrated into a highly functional and scalable Network Security Monitoring solution.

Prerequisites:

Students should have a basic understanding of networks, TCP/IP and standard protocols such as DNS, HTTP, etc. Some Linux knowledge/experience is recommended, but not required

Course Outline:

  • Network Security Monitoring (NSM) Methodology
  • High Bandwidth Packet Capture Challenges
  • Installation of Security Onion
    • Use Cases (analysis, lab, stand-alone, distributed)
    • Resource Requirements
  • Configuration
    • Setup Phase I – Network Configuration
    • Setup Phase 2 – Service Configuration
    • Evaluation Mode vs. Configuration Mode
    • Verifying Services
  • Security Onion Architecture
    • Configuration Files and Folders
    • Network Interfaces
    • Docker Environment
    • Security Onion Containers
  • Overview of Security Onion Analyst Tools
    • Kibana
    • CapME
    • CyberChef
    • Squert
    • Sguil
    • NetworkMiner
  • Quick Review of Wireshark and Packet Analysis
    • Display and Capture Filters
    • Analyze and Statistics Menu Options
    • Analysis for Signatures
  • Analyzing Alerts
    • Replaying Traffic
    • 3 Primary Interfaces:
      • Squert
      • Sguil
      • Kibana
    • Pivoting Between Interfaces
    • Pivoting to Full Packet Capture
  • Snort and Surricata
    • Rule Syntax and Construction
    • Implementing Custom Rules
    • Implementing Whitelists and Blacklists
  • Hunting
    • Using Kibana to Slice and Dice Logs
    • Hunting Workflow with Kibana
  • Bro
    • Introduction and Overview
      • Architecture, Commands
    • Understanding and Examining Bro Logs
      • Using AWK, sort, uniq, and bro-cut
    • Working with traces/PCAPs
    • Bro Scripts Overview
      • Loading and Using Scripts
    • Bro Frameworks Overview
      • Bro File Analysis Framework FAF
    • Using Bro scripts to carve out more than files
  • RockNSM ( * If Applicable)
    •  Kafka
      • Installation and Configuration
      • Kafka Messaging
      • Brokers
      • Integration with Bro and FSF
    • File Scanning Framework FSF
      • Custom YARA Signatures
      • JSON Trees
      • Sub-Object Recursion
      • Bro and Suricata Integration
  • Elastic Stack
    • Adding new data sources in Logstash
    • Enriching data with Logstash
    • Automating with Elastalert
    • Building new Kibana dashboards
  • Production Deployment
    • Advanced Setup
    • Master vs Sensor
    • Node Types – Master, Forward, Heavy, Storage
    • Command Line Setup with sosetup.conf
    • Architectural Recommendations
    • Sensor Placement
    • Hardening
    • Administration
    • Maintenance
  • Tuning
    • Using PulledPork to Disable Rules
    • BPF’s to Filter Traffic
    • Spinning up Additional Snort / Suricata / Bro Workers to Handle Higher Traffic Loads

Comments

Latest comments from students

 

Liked the class?  Then let everyone know!

CompTIA

Increase your credibility, job security, and career opportunities by reaching your goal and getting certified!  TechNow offers many CompTIA bootcamp style courses in which we administer an exam on the last day of class.  We have a proven testing program that will get you the results you want!

    in   

    CT-415: CompTIA SecAI+

    CompTIA SecAI+ is the first certification in CompTIA’s expansion series, designed to help you secure, govern and responsibly integrate artificial intelligence into your cybersecurity operations. You’ll build the skills to defend AI systems, meet global compliance expectations and use AI to enhance threat detection, automation and innovation—so you can strengthen your expertise and help keep your organization’s systems and data secure.

    SecAI+ helps you build practical AI security and automation skills on top of your existing expertise, so you can secure AI deployments, use AI‑assisted security tools with confidence, and stay ready for the next step in your cybersecurity career.

    Course Objectives:

    • Apply AI concepts to strengthen your organization’s cybersecurity posture
    • Secure AI systems using advanced controls and protections to safeguard data, models, and infrastructure
    • Leverage AI technologies to automate workflows, accelerate incident response, and scale security operations
    • Navigate global GRC frameworks to ensure ethical and compliant AI adoption across industries
    • Defend against AI-driven threats like adversarial attacks, automated malware, and malicious use of generative AI
    • Integrate AI securely into DevSecOps pipelines and enterprise security strategies.

    Dates/Locations:

    No Events

    Prerequisites: Recommended experience: 3–4 years in IT and 2+ years hands-on cybersecurity; Security+, CySA+, PenTest+, or equivalent recommended

    SecAI+ (V1) exam objectives summary

         Basic AI concepts related to cybersecurity (17%)

    • Explain core AI principles and terminology: Machine learning, deep learning, natural language processing, and automation.
    • Identify AI applications in security: Use cases for AI in threat detection, defense, and security operations. 
    • Recognize AI-driven threats: Automated phishing, polymorphic malware, adversarial machine learning, and malicious use of generative AI.

    Securing AI systems (40%)

    • Implement security controls: Protect AI systems, data, and models using robust technical safeguards. 
    • Secure AI deployment environments: Apply best practices across on-premises, cloud, and hybrid infrastructures. 
    • Mitigate adversarial risks: Defend against attacks targeting AI models, data pipelines, and inference layers. 

    AI-assisted security (24%)

    • Enhance detection and response: Use AI-driven tools to identify anomalies, detect threats, and accelerate incident remediation. 
    • Automate security workflows: Integrate AI for event triage, alert correlation, and response orchestration. 
    • Apply AI techniques in operations: Incorporate AI into threat modeling, behavior analysis, and continuous monitoring. 

    AI governance, risk, and compliance (19%)

    • Understand regulatory frameworks: Identify global governance requirements and their implications for AI adoption. 
    • Integrate GRC into AI projects: Incorporate governance, risk management, and compliance practices throughout the AI lifecycle. 
    • Ensure responsible AI use: Apply ethical guidelines, legal standards, and industry frameworks such as GDPR and NIST AI RMF.

    N-415: Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR)

    Course Overview:

    The Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) course gives you the knowledge and skills needed to configure, troubleshoot, and manage enterprise wired and wireless networks. You’ll also learn to implement security principles, implement automation and programmability within an enterprise network, and how to overlay network design by using SD-Access and SD-WAN solutions.

    Attendees to N-415: Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) will receive TechNow approved course materials, expert instruction, and prepare you to take the 350-401 Implementing Cisco® Enterprise Network Core Technologies (ENCOR) exam.

    Document Flow Chart iconsm

    Dates/Locations:

    No Events

    Duration: 5 Days

    Course Objectives:

    • Illustrate the hierarchical network design model and architecture using the access, distribution, and core layers
    • Compare and contrast the various hardware and software switching mechanisms and operation, while defining the Ternary Content Addressable Memory (TCAM) and Content Addressable Memory (CAM), along with process switching, fast switching, and Cisco Express Forwarding concepts
    • Troubleshoot Layer 2 connectivity using VLANs and trunking
    • Implementation of redundant switched networks using Spanning Tree Protocol
    • Troubleshooting link aggregation using Etherchannel
    • Describe the features, metrics, and path selection concepts of Enhanced Interior Gateway Routing Protocol (EIGRP)
    • Implementation and optimization of Open Shortest Path First (OSPF)v2 and OSPFv3, including adjacencies, packet types, and areas, summarization, and route filtering for IPv4 and IPv6
    • Implementing External Border Gateway Protocol (EBGP) interdomain routing, path selection, and single and dual-homed networking
    • Implementing network redundancy using protocols including Hot Standby Routing Protocol (HSRP) and Virtual Router Redundancy Protocol (VRRP)
    • Implementing internet connectivity within Enterprise using static and dynamic Network Address Translation (NAT)
    • Describe the virtualization technology of servers, switches, and the various network devices and components
    • Implementing overlay technologies such as Virtual Routing and Forwarding (VRF), Generic Routing Encapsulation (GRE), VPN, and Location Identifier Separation Protocol (LISP)
    • Describe the components and concepts of wireless networking including Radio Frequency (RF) and antenna characteristics, and define the specific wireless standards
    • Describe the various wireless deployment models available, include autonomous Access Point (AP) deployments and cloud-based designs within the centralized Cisco Wireless LAN Controller (WLC) architecture
    • Describe wireless roaming and location services
    • Describe how APs communicate with WLCs to obtain software, configurations, and centralized management
    • Configure and verify Extensible Authentication Protocol (EAP), WebAuth, and Pre-Shared Key (PSK) wireless client authentication on a WLC
    • Troubleshoot wireless client connectivity issues using various available tools
    • Troubleshooting Enterprise networks using services such as Network Time Protocol (NTP), Simple Network Management Protocol (SNMP), Cisco Internetwork Operating System (Cisco IOS®) IP Service Level Agreements (SLAs), NetFlow, and Cisco IOS Embedded Event Manager
    • Explain the use of available network analysis and troubleshooting tools, which include show and debug commands, as well as best practices in troubleshooting
    • Configure secure administrative access for Cisco IOS devices using the Command-Line Interface (CLI) access, Role-Based Access Control (RBAC), Access Control List (ACL), and Secure Shell (SSH), and explore device hardening concepts to secure devices from less secure applications, such as Telnet and HTTP
    • Implement scalable administration using Authentication, Authorization, and Accounting (AAA) and the local database, while exploring the features and benefits
    • Describe the enterprise network security architecture, including the purpose and function of VPNs, content security, logging, endpoint security, personal firewalls, and other security features
    • Explain the purpose, function, features, and workflow of Cisco DNA Center™ Assurance for Intent-Based Networking, for network visibility, proactive monitoring, and application experience
    • Describe the components and features of the Cisco SD-Access solution, including the nodes, fabric control plane, and data plane, while illustrating the purpose and function of the Virtual Extensible LAN (VXLAN) gateways
    • Define the components and features of Cisco SD-WAN solutions, including the orchestration plane, management plane, control plane, and data plane
    • Describe the concepts, purpose, and features of multicast protocols, including Internet Group Management Protocol (IGMP) v2/v3, Protocol-Independent Multicast (PIM) dense mode/sparse mode, and rendezvous points
    • Describe the concepts and features of Quality of Service (QoS), and describe the need within the enterprise network
    • Explain basic Python components and conditionals with script writing and analysis
    • Describe network programmability protocols such as Network Configuration Protocol (NETCONF) and RESTCONF
    • Describe APIs in Cisco DNA Center and vManage

    Prerequisites:

    • CCNA certification
    • Implementation of Enterprise LAN networks
    • Basic understanding of Enterprise routing and wireless connectivity
    • Basic understanding of Python scripting

     

    Comments

    Latest comments from students

    User: don.seguin

    Instructor comments: Tim was a great.

    Facilities comments: The classroom was great.

    User: jrtrussell

    Instructor comments: Awesome

    Facilities comments: Great

    Liked the class?  Then let everyone know!

    TN-715: Systems Security Certified Practitioner (SSCP)

    Course Overview:

    Looking to move up in the information security field? If you have at least one year of security experience, you qualify for the Systems Security Certified Practitioner (SSCP) certification, which offers junior security professionals a way to validate their experience and demonstrate competence with (ISC²)®’s seven domains.

    Attendees to TN-715: Systems Security Certified Practitioner (SSCP) will receive TechNow approved course materials and expert instruction.

    Dates/Locations:

    No Events

    Duration: 5 Days

    Course Objectives:

    • Access Controls
    • Security Operations and Administration
    • Analysis and Monitoring
    • Cryptography
    • Networks and Telecommunications
    • Malicious Code/Malware
    • Risk, Response, and Recovery

    Prerequisites:

    • One year security experience
    • Some knowledge of the (ISC²)®’s seven domains

    Comments

    Latest comments from students

    User: boyleb15

    Instructor comments: Instructor was very knowledgeable on most items covered during this course. There were some topics he did lack the answer to. Instructor would also get sidetracked easily

    User: keginth

    Instructor comments: he was phenomenal with test prep and knew the book well

    Facilities comments: adequate

    Like the class?  Then let everyone know!