TN-575: Open Source Network Security Monitoring

 

Course Overview:

TN-575: Open Source Network Security Monitoring teaches students how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools. No network is bullet proof and when attackers access your network, this course will show you how to build a security net to detect, contain, and control the attacker. Sensitive data can be monitored and deep packet and deep attachment analysis can be achieved. As organizations stand up a Security Operations Center (SOC) the enterprise NSM is the key ingredient to that SOC. This course not only teaches how to implement an NSM technologically, but how to effectively monitor an enterprise operationally. You will learn how to architect an NSM solution: where to deploy your NSM platforms and how to size them, stand-alone or distributed, and integration into packet analysis, interpret evidence, and integrate threat intelligence from external sources to identify sophisticated attackers. A properly implemented NSM is integral to incident response and provides the responders timely information to react to the incident. TN-575: Open Source Network Security Monitoring is a lab intensive environment with a cyber range that gives each student in-depth knowledge and practical experience monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls.

Attendees to TN-575: Open Source Network Security Monitoring class will receive TechNow approved course materials and expert instruction.

This Course is taught utilizing Security Onion or RockNSM as specified by the customer.

Dates/Locations:

No Events

Duration: 5 Days

Course Objective:

The focus of this course is to present a suite of Open Source security products integrated into a highly functional and scalable Network Security Monitoring solution.

Prerequisites:

Students should have a basic understanding of networks, TCP/IP and standard protocols such as DNS, HTTP, etc. Some Linux knowledge/experience is recommended, but not required

Course Outline:

  • Network Security Monitoring (NSM) Methodology
  • High Bandwidth Packet Capture Challenges
  • Installation of Security Onion
    • Use Cases (analysis, lab, stand-alone, distributed)
    • Resource Requirements
  • Configuration
    • Setup Phase I – Network Configuration
    • Setup Phase 2 – Service Configuration
    • Evaluation Mode vs. Configuration Mode
    • Verifying Services
  • Security Onion Architecture
    • Configuration Files and Folders
    • Network Interfaces
    • Docker Environment
    • Security Onion Containers
  • Overview of Security Onion Analyst Tools
    • Kibana
    • CapME
    • CyberChef
    • Squert
    • Sguil
    • NetworkMiner
  • Quick Review of Wireshark and Packet Analysis
    • Display and Capture Filters
    • Analyze and Statistics Menu Options
    • Analysis for Signatures
  • Analyzing Alerts
    • Replaying Traffic
    • 3 Primary Interfaces:
      • Squert
      • Sguil
      • Kibana
    • Pivoting Between Interfaces
    • Pivoting to Full Packet Capture
  • Snort and Surricata
    • Rule Syntax and Construction
    • Implementing Custom Rules
    • Implementing Whitelists and Blacklists
  • Hunting
    • Using Kibana to Slice and Dice Logs
    • Hunting Workflow with Kibana
  • Bro
    • Introduction and Overview
      • Architecture, Commands
    • Understanding and Examining Bro Logs
      • Using AWK, sort, uniq, and bro-cut
    • Working with traces/PCAPs
    • Bro Scripts Overview
      • Loading and Using Scripts
    • Bro Frameworks Overview
      • Bro File Analysis Framework FAF
    • Using Bro scripts to carve out more than files
  • RockNSM ( * If Applicable)
    •  Kafka
      • Installation and Configuration
      • Kafka Messaging
      • Brokers
      • Integration with Bro and FSF
    • File Scanning Framework FSF
      • Custom YARA Signatures
      • JSON Trees
      • Sub-Object Recursion
      • Bro and Suricata Integration
  • Elastic Stack
    • Adding new data sources in Logstash
    • Enriching data with Logstash
    • Automating with Elastalert
    • Building new Kibana dashboards
  • Production Deployment
    • Advanced Setup
    • Master vs Sensor
    • Node Types – Master, Forward, Heavy, Storage
    • Command Line Setup with sosetup.conf
    • Architectural Recommendations
    • Sensor Placement
    • Hardening
    • Administration
    • Maintenance
  • Tuning
    • Using PulledPork to Disable Rules
    • BPF’s to Filter Traffic
    • Spinning up Additional Snort / Suricata / Bro Workers to Handle Higher Traffic Loads

Comments

Latest comments from students

 

Liked the class?  Then let everyone know!

TN-225: Network+ Skills Class

 

Course Overview:

TN-225: Network+ Skills Class is a five-day course that teaches students the fundamentals of networking. Through hands-on training, students learn the vendor-independent networking skills & concepts that affect all aspects of networking, such as installing & configuring the TCP/IP client. 

Attendees to the TN-225: Network+ Skills Class will receive TechNow approved course materials and expert instruction.

Please Note:  This course is designed with a focus on skills and is not a preparation course for certification.

Dates/Locations:

No Events

Duration 5 days

Course Objectives:

  • Introduction Defining Networking
  • Building a Network with OSI
  • Hardware Concepts
  • Ethernet Basics
  • Modern Ethernet
  • Non-Ethernet Networks
  • Installing a Physical Network
  • Wireless Networking
  • Protocols
  • TCP/IP
  • Network Operating Systems
  • Sharing Resources
  • Going Large with TCP/IP
  • TCP/IP & the Internet
  • Remote Connectivity
  • Protecting Your Network
  • Interconnecting Network Operating Systems
  • The Perfect Server
  • Zen & the Art of Network Support

Prerequisites:

Comments

Latest comments from students

User: dsm

Instructor comments: great presentation

Facilities comments: too cold

User: fillyok

Instructor comments: He has an excellent way of explaining things on the level that anyone can understand easily. I wasn't looking forward to this class at all but I'm really glad I attended now. I have a much clearer understanding of networking fundamentals that I never would've received via CBTs. I'd heard really good things about Tim Burkard's teaching skills and now I know they're true. I wouldn't mind taking other classes that he teaches,

Facilities comments: The facilities are really nice and there weren't any problems as far as I could tell. The hotel staff is very nice.

 

Like the class?  Then let everyone know!

Cisco

Are you looking for a Cisco Training Course?

Your organization needs qualified professionals who can design, implement, and operate Cisco multiprotocol internet works.  With Cisco training from TechNow, you can gain the knowledge and experience your organization needs to succeed.

TechNow’s Cisco Training and Certification Career Path takes students from the fundamentals of networking through a complete line of Cisco courses designed to give students the knowledge and experience they need to master Cisco networking skills in a fast, thorough, and efficient manner.

Our Cisco training courses will prepare you for your work towards Cisco certification.  With years of experience in the Cisco training environment, TechNow can lead you through a dynamic experience to prepare you for Cisco certification.

A list of our Cisco Courses.

in   

TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies

 

Course Overview:

TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies is the big picture overview of a SOC, other courses provide a deep dive into the technologies that a SOC may utilize. This course addresses the internal workings of staff, skills required, required authorizations, internal agreements, and setting appropriate expectation levels of a SOC within budget constraints. A SOC is not a one size fits all, the instructor has decades of security experience and brings to the table opportunities to discuss what can work within constraints. Many organizations are coming to the realization that some level of a SOC is now required and to learn just what decisions need to be made: Out-sourced, In-sourced, budgets, capabilities and many more. Students leave with a worksheet of how to progress when they get back to their organization.

TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies – Is a course that incorporates lecture, demos, and group exercises for standing up a Security Operations Center (SOC). Students learn strategies and resources required to deploy, build, and run Network Security Monitoring (NSM) and work roles and flows for a SOC. No network is bullet proof and when attackers access your network, this course will show you options and resources to build a security net to detect, contain, and control the attacker. Examples on what it takes to architect an NSM solution to identify sophisticated attackers and a response strategy. Properly implemented detection and response technologies is integral to incident response and provides the responders timely information and tools to react to the incident. Effective demonstrations are given of Open Source technologies that build up a SOC, but any software can be used and demonstrations are provided to demonstrate technology families not push a specific solution.

TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies demonstrations utilize a cyber range that gives each student in-depth knowledge of monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls; and software and services to provide orchestrate Incident Response, Intelligence Analysis, and Hunt Operations.

Attendees to TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies class will receive TechNow approved course materials and expert instruction.

Dates/Locations:

No Events

Duration: 2 Days

Course Objective:

    • To provide management an overview of what it takes to stand up a SOC.

Prerequisites:

  • Students should have an understanding of the security field.

Course Outline:

  • What threats does my organization care about?
  • What does a threat look like?
  • What does a threat look like?
  • How to present the SOC internally.
  • Communication with Stakeholders and Executives
    • Leveraging and integrating existing security measures
  • People
    • Establishing a skill matrix and work roles for SOC members
    • Establishing a training path
    • Personnel background requirementsProcesses
  • Processes
    • Alignment to standards: NIST, PCI, HIPAA, etc.
    • Risk related decision trees
    • Playbooks
    • Threat Intelligence Integration
  • Technology – Tool Suites to Support:
    • Ethical Hacking
    • Network Security Monitoring and SIEM
    • Forensics
    • Dashboards
    • Analysis and Hunting
    • Incident Management and Ticketing

 

Comments

Latest comments from students

 

Liked the class?  Then let everyone know!

CT-425: CompTIA SecurityX

Course Overview:

SecurityX®  (formerly known as CASP+)  course prepares you for the CompTIA SecurityX® certification exam (CVO-005) and demonstrates your knowledge and skills in enterprise security, risk management, research and analysis, and the integration of computing, communications, and business disciplines. This course will prepare students for the objectives covered in the CompTIA SecurityX certification exam (CVO-005).

Attendees to CT-425: CompTIA SecurityX will receive TechNow approved course materials and expert instruction.

Date/Locations:

Date/Time Event
06/09/2025 - 06/13/2025
09:00 -17:00 		CT-425: CompTIA Advanced Security Practitioner (CASP+)
TechNow, Inc, San Antonio TX
09/15/2025 - 09/19/2025
09:00 -17:00 		CT-425: CompTIA Advanced Security Practitioner (CASP+)
TechNow, Inc, San Antonio TX
12/08/2025 - 12/12/2025
09:00 -17:00 		CT-425: CompTIA Advanced Security Practitioner (CASP+)
TechNow, Inc, San Antonio TX

Duration: 5 days

Course Objectives:

  • Support IT governance in the enterprise with an emphasis on managing risk
  • Leverage collaboration tools and technology to support enterprise security
  • Use research and analysis to secure the enterprise
  • Integrate advanced authentication and authorization techniques
  • Implement cryptographic techniques
  • Implement security controls for hosts
  • Implement security controls for mobile devices
  • Implement network security
  • Implement security in the systems and software development lifecycle
  • Integrate hosts, storage, networks, applications, virtual environments, and cloud technologies in a secure enterprise architecture
  • Conduct security assessments
  • Respond to and recover from security incidents

Prerequisites:

Completion of the following or equivalent knowledge:

Minimum of 10 years general hands on IT experience

5 years being hands-on security

CompTIA Certification: Network+

CompTIA Certification: Security+

CompTIA Certification: CySA+

OR equivalent knowledge

Comments

Latest comments from students

User: clbrack

Instructor comments: I expect to pass, another great class from technow!

User: christopher0470

Instructor comments: Alan takes the time to cover the material so that you understand the concepts and applications of the information presented.

Facilities comments: I like the location. It was quiet and very conducive to learning.

Liked the class?  Then let everyone know!