Our TechNow Corporate Headquarters is located at:
14117 Jones Maltsberger San Antonio, TX 78247 (210) 733-1093
Course Overview:
TN-575: Open Source Network Security Monitoring teaches students how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools. No network is bullet proof and when attackers access your network, this course will show you how to build a security net to detect, contain, and control the attacker. Sensitive data can be monitored and deep packet and deep attachment analysis can be achieved. As organizations stand up a Security Operations Center (SOC) the enterprise NSM is the key ingredient to that SOC. This course not only teaches how to implement an NSM technologically, but how to effectively monitor an enterprise operationally. You will learn how to architect an NSM solution: where to deploy your NSM platforms and how to size them, stand-alone or distributed, and integration into packet analysis, interpret evidence, and integrate threat intelligence from external sources to identify sophisticated attackers. A properly implemented NSM is integral to incident response and provides the responders timely information to react to the incident. TN-575: Open Source Network Security Monitoring is a lab intensive environment with a cyber range that gives each student in-depth knowledge and practical experience monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls.
Attendees to TN-575: Open Source Network Security Monitoring class will receive TechNow approved course materials and expert instruction.
This Course is taught utilizing Security Onion or RockNSM as specified by the customer.
Dates/Locations:
No Events
Duration: 5 Days
Course Objective:
The focus of this course is to present a suite of Open Source security products integrated into a highly functional and scalable Network Security Monitoring solution.
Prerequisites:
Students should have a basic understanding of networks, TCP/IP and standard protocols such as DNS, HTTP, etc. Some Linux knowledge/experience is recommended, but not required
Course Outline:
- Network Security Monitoring (NSM) Methodology
- High Bandwidth Packet Capture Challenges
- Installation of Security Onion
- Use Cases (analysis, lab, stand-alone, distributed)
- Resource Requirements
- Configuration
- Setup Phase I – Network Configuration
- Setup Phase 2 – Service Configuration
- Evaluation Mode vs. Configuration Mode
- Verifying Services
- Security Onion Architecture
- Configuration Files and Folders
- Network Interfaces
- Docker Environment
- Security Onion Containers
- Overview of Security Onion Analyst Tools
- Kibana
- CapME
- CyberChef
- Squert
- Sguil
- NetworkMiner
- Quick Review of Wireshark and Packet Analysis
- Display and Capture Filters
- Analyze and Statistics Menu Options
- Analysis for Signatures
- Analyzing Alerts
- Replaying Traffic
- 3 Primary Interfaces:
- Squert
- Sguil
- Kibana
- Pivoting Between Interfaces
- Pivoting to Full Packet Capture
- Snort and Surricata
- Rule Syntax and Construction
- Implementing Custom Rules
- Implementing Whitelists and Blacklists
- Hunting
- Using Kibana to Slice and Dice Logs
- Hunting Workflow with Kibana
- Bro
- Introduction and Overview
- Architecture, Commands
- Understanding and Examining Bro Logs
- Using AWK, sort, uniq, and bro-cut
- Working with traces/PCAPs
- Bro Scripts Overview
- Loading and Using Scripts
- Bro Frameworks Overview
- Bro File Analysis Framework FAF
- Using Bro scripts to carve out more than files
- Introduction and Overview
- RockNSM ( * If Applicable)
- Kafka
- Installation and Configuration
- Kafka Messaging
- Brokers
- Integration with Bro and FSF
- File Scanning Framework FSF
- Custom YARA Signatures
- JSON Trees
- Sub-Object Recursion
- Bro and Suricata Integration
- Kafka
- Elastic Stack
- Adding new data sources in Logstash
- Enriching data with Logstash
- Automating with Elastalert
- Building new Kibana dashboards
- Production Deployment
- Advanced Setup
- Master vs Sensor
- Node Types – Master, Forward, Heavy, Storage
- Command Line Setup with sosetup.conf
- Architectural Recommendations
- Sensor Placement
- Hardening
- Administration
- Maintenance
- Tuning
- Using PulledPork to Disable Rules
- BPF’s to Filter Traffic
- Spinning up Additional Snort / Suricata / Bro Workers to Handle Higher Traffic Loads
Comments
Latest comments from students
Liked the class? Then let everyone know!
Security Course Flow
Here is our list of security related courses.
- CL-218: Introduction to Cloud Infrastructure and Operations Bootcamp
- CL-315: CCSP – Certified Cloud Security Professional Preparation Seminar
- CL-415: AWS System Operations
- CL-425: AWS Security Operations and Architecture
- CT-325: Security+
- CT-395: CySA+ Cybersecurity Analyst
- CT-405: PenTest+
- CT-425: CompTIA SecurityX
- N-305: CCNA Bootcamp
- N-325: Implementing Cisco IOS Network Security (IINS)
- N-415: Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR)
- N-425 : Implementing Cisco Enterprise Advanced Routing and Services ( ENARSI)
- N-485: In-Depth Securing Networks with Cisco Firepower Threat Defense NGFW
- N-595: VoIP Security Analysis and Design
- PA-212: Palo Alto Networks Firewall Configure Extended Features (EDU-205)
- PA-213: Palo Alto Networks Firewall Install, Configure, and Manage (EDU-201)
- PA-215: Palo Alto Networks Firewall Essentials FastTrack
- PA-222: Palo Alto Networks Panorama Essentials
- PA-232: Palo Alto Networks Panorama Manage Multiple Firewalls (EDU-221)
- PP-212: CIPP/E Certified Information Privacy Professional Europe and GDPR Compliance
- PP-222: CIPM Certified Information Privacy Manager and GDPR Compliance
- PP-244:CIPM + CIPP/E 4 Day GDPR Ready
- TN-305: Designing, Implementing, Administering and Securing Wireless Local Area Networks (LANs)
- TN-315: Complete Hack and Defend
- TN-335: Advanced Penetration Testing Using Open Source Tools
- TN-345: Python for Penetration Testers
- TN-385: TCP/IP Analysis & Implementation
- TN-415: Computer Hacking Forensics Investigator (CHFI)
- TN-430: Elasticsearch Engineer (ELK)
- TN-515: Implementing Cybersecurity and Information Assurance Methodologies
- TN-525: Certified Penetration Testing Professional (CPENT)
- TN-535: Certified Forensic Computer Examiner (CFCE)
- TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies
- TN-545: Certified Network Defender
- TN-555: Certified Ethical Hacker v13 (CEH)
- TN-565: Nessus Vulnerability & Compliance Auditing
- TN-575: Open Source Network Security Monitoring
- TN-715: Systems Security Certified Practitioner (SSCP)
- TN-765: Automating Administration with Windows Powershell
- TN-801: Windows for Security Professionals
- TN-812: Information Systems Security Engineering Professional (ISSEP)
- TN-813: Certified in Governance, Risk and Compliance (CGRC)
- TN-8150: CISSP Certification Preparation Seminar
- TN-8155: HCISPP Preparation Seminar
- TN-822: Certified Information Systems Auditor (CISA) Seminar
- TN-825: Certified Information Security Manager (CISM) Seminar
- TN-835: Certified in Risk and Information Systems Control (CRISC) Preparation Seminar
- TN-855: Advanced and In-Depth ICD 503 RMF, Controls, and Assessments
- TN-865: Wireshark Network Traffic and Security Analysis
- TN-901: Linux for Security Professionals
- TN-905: Cyber Threat Intelligence Analysis
- TN-909: Windows Forensic Analysis
- TN-911: Cyber Threat Intelligence (CTI) Analysis and 800-172 Seminar
- TN-913: Cloud Security Fundamentals
- TN-919: Penetration Tester Course
- TN-929: Security Essentials Training Course
- TN-939: Hacker Techniques, Exploits, and Incident Handling Course
- TN-949: Certified Firewall Analyst Course
- TN-959: UNIX Security Administrator Course
- TN-963: Windows Security Automation with PowerShell
- TN-965 Windows Security Automation with Powershell
- TN-969: Windows Security Administrator Course
- TN-979: Intrusion Analyst Course
- TN-989: Advanced Penetration Testing, Exploits, and Ethical Hacking Course
- TN-999: Reverse Engineering Malware Course
Course Overview:
CT-395: CompTIA CySA+ Cybersecurity Analyst is for IT professionals looking to gain IT security analyst skills, and for those following the recommended skills pathway to achieve cybersecurity mastery. It provides a bridge between CompTIA Security+ (CT-325) and CompTIA SecurityX (CT-425), thus completing a certification path within the CompTIA family of certifications. As attackers have learned to evade traditional signature-based solutions, an analytics-based approach has become extremely important. CySA+ applies behavioral analytics to the IT security market to improve the overall state of security. The CompTIA Cybersecurity Analyst (CySA+) certification verifies that successful candidates have the knowledge and skills required to configure and use threat detection tools, perform data analysis and interpret the results to identify vulnerabilities, threats and risks to an organization, with the end goal of securing and protecting applications and systems within an organization. Let us help you bridge this gap, and leave you prepared for the certification exam (CS0-003).
TechNow is a CompTIA partner uses official CompTIA CySA+ curriculum.
Dates/Locations:
| Date/Time | Event |
|---|---|
|
03/02/2026 - 03/06/2026 08:00 -16:00 |
CT-395: CySA+ Cybersecurity Analyst TechNow, Inc, San Antonio TX |
|
06/01/2026 - 06/05/2026 08:00 -16:00 |
CT-395: CySA+ Cybersecurity Analyst TechNow, Inc, San Antonio TX |
|
08/24/2026 - 08/28/2026 08:00 -16:00 |
CT-395: CySA+ Cybersecurity Analyst TechNow, Inc, San Antonio TX |
|
11/16/2026 - 11/20/2026 08:00 -16:15 |
CT-395: CySA+ Cybersecurity Analyst TechNow, Inc, San Antonio TX |
Duration: 5 Days
Course Objectives:
- Threat Management
- Vulnerability Management
- Cyber Incident Response
- Security Architecture and Tool Sets
Prerequisites:
While there is no required prerequisite, the CompTIA CySA+ certification is intended to follow CT-325: Security+ or equivalent experience. It is recommended for CompTIA CySA+ candidates to have the following:
- 3-4 years of hands-on information security or related experience
- Network+, Security+, or equivalent knowledge.
Comments
Latest comments from students
Liked the class? Then let everyone know!
Course Overview:
The Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) course gives you the knowledge and skills needed to configure, troubleshoot, and manage enterprise wired and wireless networks. You’ll also learn to implement security principles, implement automation and programmability within an enterprise network, and how to overlay network design by using SD-Access and SD-WAN solutions.
Attendees to N-415: Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) will receive TechNow approved course materials, expert instruction, and prepare you to take the 350-401 Implementing Cisco® Enterprise Network Core Technologies (ENCOR) exam.
Dates/Locations:
| Date/Time | Event |
|---|---|
|
03/09/2026 - 03/13/2026 08:00 -16:00 |
N-415: Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) TechNow, Inc, San Antonio TX |
|
06/29/2026 - 07/03/2026 08:00 -16:00 |
N-415: Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) TechNow, Inc, San Antonio TX |
|
10/05/2026 - 10/09/2026 08:00 -16:00 |
N-415: Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) TechNow, Inc, San Antonio TX |
Duration: 5 Days
Course Objectives:
- Illustrate the hierarchical network design model and architecture using the access, distribution, and core layers
- Compare and contrast the various hardware and software switching mechanisms and operation, while defining the Ternary Content Addressable Memory (TCAM) and Content Addressable Memory (CAM), along with process switching, fast switching, and Cisco Express Forwarding concepts
- Troubleshoot Layer 2 connectivity using VLANs and trunking
- Implementation of redundant switched networks using Spanning Tree Protocol
- Troubleshooting link aggregation using Etherchannel
- Describe the features, metrics, and path selection concepts of Enhanced Interior Gateway Routing Protocol (EIGRP)
- Implementation and optimization of Open Shortest Path First (OSPF)v2 and OSPFv3, including adjacencies, packet types, and areas, summarization, and route filtering for IPv4 and IPv6
- Implementing External Border Gateway Protocol (EBGP) interdomain routing, path selection, and single and dual-homed networking
- Implementing network redundancy using protocols including Hot Standby Routing Protocol (HSRP) and Virtual Router Redundancy Protocol (VRRP)
- Implementing internet connectivity within Enterprise using static and dynamic Network Address Translation (NAT)
- Describe the virtualization technology of servers, switches, and the various network devices and components
- Implementing overlay technologies such as Virtual Routing and Forwarding (VRF), Generic Routing Encapsulation (GRE), VPN, and Location Identifier Separation Protocol (LISP)
- Describe the components and concepts of wireless networking including Radio Frequency (RF) and antenna characteristics, and define the specific wireless standards
- Describe the various wireless deployment models available, include autonomous Access Point (AP) deployments and cloud-based designs within the centralized Cisco Wireless LAN Controller (WLC) architecture
- Describe wireless roaming and location services
- Describe how APs communicate with WLCs to obtain software, configurations, and centralized management
- Configure and verify Extensible Authentication Protocol (EAP), WebAuth, and Pre-Shared Key (PSK) wireless client authentication on a WLC
- Troubleshoot wireless client connectivity issues using various available tools
- Troubleshooting Enterprise networks using services such as Network Time Protocol (NTP), Simple Network Management Protocol (SNMP), Cisco Internetwork Operating System (Cisco IOS®) IP Service Level Agreements (SLAs), NetFlow, and Cisco IOS Embedded Event Manager
- Explain the use of available network analysis and troubleshooting tools, which include show and debug commands, as well as best practices in troubleshooting
- Configure secure administrative access for Cisco IOS devices using the Command-Line Interface (CLI) access, Role-Based Access Control (RBAC), Access Control List (ACL), and Secure Shell (SSH), and explore device hardening concepts to secure devices from less secure applications, such as Telnet and HTTP
- Implement scalable administration using Authentication, Authorization, and Accounting (AAA) and the local database, while exploring the features and benefits
- Describe the enterprise network security architecture, including the purpose and function of VPNs, content security, logging, endpoint security, personal firewalls, and other security features
- Explain the purpose, function, features, and workflow of Cisco DNA Center™ Assurance for Intent-Based Networking, for network visibility, proactive monitoring, and application experience
- Describe the components and features of the Cisco SD-Access solution, including the nodes, fabric control plane, and data plane, while illustrating the purpose and function of the Virtual Extensible LAN (VXLAN) gateways
- Define the components and features of Cisco SD-WAN solutions, including the orchestration plane, management plane, control plane, and data plane
- Describe the concepts, purpose, and features of multicast protocols, including Internet Group Management Protocol (IGMP) v2/v3, Protocol-Independent Multicast (PIM) dense mode/sparse mode, and rendezvous points
- Describe the concepts and features of Quality of Service (QoS), and describe the need within the enterprise network
- Explain basic Python components and conditionals with script writing and analysis
- Describe network programmability protocols such as Network Configuration Protocol (NETCONF) and RESTCONF
- Describe APIs in Cisco DNA Center and vManage
Prerequisites:
- CCNA certification
- Implementation of Enterprise LAN networks
- Basic understanding of Enterprise routing and wireless connectivity
- Basic understanding of Python scripting
Comments
Latest comments from students
User: don.seguin
Instructor comments: Tim was a great.
Facilities comments: The classroom was great.
User: jrtrussell
Instructor comments: Awesome
Facilities comments: Great