TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies

Course Overview:

TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies is the big picture overview of a SOC, other courses provide a deep dive into the technologies that a SOC may utilize. This course addresses the internal workings of staff, skills required, required authorizations, internal agreements, and setting appropriate expectation levels of a SOC within budget constraints. A SOC is not a one size fits all, the instructor has decades of security experience and brings to the table opportunities to discuss what can work within constraints. Many organizations are coming to the realization that some level of a SOC is now required and to learn just what decisions need to be made: Out-sourced, In-sourced, budgets, capabilities and many more. Students leave with a worksheet of how to progress when they get back to their organization.

TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies – Is a course that incorporates lecture, demos, and group exercises for standing up a Security Operations Center (SOC). Students learn strategies and resources required to deploy, build, and run Network Security Monitoring (NSM) and work roles and flows for a SOC. No network is bullet proof and when attackers access your network, this course will show you options and resources to build a security net to detect, contain, and control the attacker. Examples on what it takes to architect an NSM solution to identify sophisticated attackers and a response strategy. Properly implemented detection and response technologies is integral to incident response and provides the responders timely information and tools to react to the incident. Effective demonstrations are given of Open Source technologies that build up a SOC, but any software can be used and demonstrations are provided to demonstrate technology families not push a specific solution.

TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies demonstrations utilize a cyber range that gives each student in-depth knowledge of monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls; and software and services to provide orchestrate Incident Response, Intelligence Analysis, and Hunt Operations.

Attendees to TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies class will receive TechNow approved course materials and expert instruction.

Dates/Locations:

No Events

Duration: 2 Days

Course Objective:

Prerequisites:

Students should have an understanding of the security field.

Course Outline:

What threats does my organization care about?
What does a threat look like?
What does a threat look like?
How to present the SOC internally.
Communication with Stakeholders and Executives
People
- Establishing a skill matrix and work roles for SOC members
- Establishing a training path
- Personnel background requirementsProcesses
Processes
- Alignment to standards: NIST, PCI, HIPAA, etc.
- Risk related decision trees
- Playbooks
- Threat Intelligence Integration
Technology – Tool Suites to Support:
- Ethical Hacking
- Network Security Monitoring and SIEM
- Forensics
- Dashboards
- Analysis and Hunting
- Incident Management and Ticketing

Comments

Latest comments from students

Liked the class? Then let everyone know!

TN-911: Cyber Threat Intelligence (CTI) Analysis and 800-172 Seminar

Course Overview:

TechNow’s TN-911: Cyber Threat Intelligence (CTI) Analysis and 800-172 Updates Seminar, is a one day seminar that covers the objectives of TechNow’s TN-905: Cyber Threat Intelligence Analysis five day course in a one day seminar format plus some other security enhancements of 800-172. Upon request, this seminar can be presented in multi-day format based upon the depth of knowledge required. The NIST PUB 800-172 security enhancement update to 800-171 regarding 03.11.1 Risk Assessment, introduces the security enhancements of a Threat Awareness Program, Threat Hunting, and Predictive Cyber Analytics. TN-911 distills the TN-905 CTI five day course and aligns it to assessing compliance with 800-172. For the seminar, selected course labs are converted to demos, and the important points and outcomes of topics are presented. The TN-911 CTI Seminar discusses the applicability of the 800-172 security enhancements to the organization being assessed, and how to think about the the appropriate strength of the controls related to the organizations criticality of the information and the risk involved for contracted work with the DoD.

TechNow’s TN-911: Cyber Threat Intelligence Analysis Seminar addresses significant changes that have been made to SP 800-172 in transitioning to Revision 3, regarding new enhanced security requirements based on (1) the latest threat intelligence and (2) empirical data from cyber-attacks. With the intent of addressing CUI that may be associated with a critical program or a high value asset.

Those programs and assets are potential targets for advanced persistent threat (APT). Cyber Threat Intelligence supports the required functions of NIST 800-172 of Penetration Resistant Architecture (PRA), Damage Limiting Operations (DLO) and Cyber Resiliency (CRS).

Regarding 800-172 This seminar includes:

3.2.1E Awareness Training (rev 3 – Advanced Literacy and Awareness Training)
3.11.6E Supply Chain Risk Management SCRM (rev 3 withdrawn, moved to other controls)
3.11.7E SCRM Planning (rev 3 withdrawn, moved to other controls)
3.12.1E Penetration Testing
800-172, 3.11 Risk Assessment
- 03.11.01E Threat Awareness Program
- 03.11.02E Threat Hunting
- 03.11.03E Predictive Cyber Analytics.

TN-911 CTI Seminar directly discusses 3.11 topics:

03.11.01E Threat Awareness Program:

Share threat information, including threat events of 03.11.01E is specifically covered as:

Create Indicators of Compromise (IOCs) using STIX
Understand a solution for collecting, storing, distributing and sharing cyber security indicators and threats about cyber security incidents analysis and malware analysis.
How to assess an environment to validate:
- Support for day-to-day operations to share structured threat information efficiently.
- Confirming the presence of curated, frequently updated feeds, and the automation of enrichment workflow
- Contextualization of intelligence with internal data to prioritize alerts and improve detection
- Updated threat hunting based upon inbound Threat Intelligence

03.11.02E Threat Hunting:

Introduction to Threat Hunting practices to effectively search for indicators of compromise and to detect, track, and disrupt threats that evade existing controls.

How to assess an environment to validate:
A formalized process is being followed for Threat Hunting
- Phases of trigger (incident or CTI), SIEM utilization, and response
Integration of machine learning to provide proactive, automated, and scalable Threat Hunting
Leveraging threat intelligence for proactive threat hunting by querying historical logs for indicators of compromise (IOCs) from feeds to identify:
Dormant threats
Advance Persistent Threats (APT)

03.11.03E Predictive Cyber Analytics

Introduction leveraging data, machine learning, and real-time analysis with automation to anticipate threats before they occur.

How to assess an environment to validate:
- Data aggregation from network logs, user activities, system logs, and external threat intelligence feeds into a centralized platform like a SIEM
Use of machine learning algorithms to identify patterns, uncover correlations, and spot anomalies in real-time
Integration with incident response workflows
Staff skill competency level and integration into Predictive Cyber Analytics to mitigate advanced adversarial techniques against machine learning such as:
- Attacks of Evasion, Poisoning, and Model Tampering
- Utilization of exercises or Red Teaming to validate practices and effectiveness of Predictive Cyber Analytics.

3.2.1E Awareness Training (rev 3 – Advanced Literacy and Awareness Training)

Validate that training addresses APT

3.11.6E Supply Chain Risk Management SCRM (rev 3 withdrawn, moved to other controls)

Validate cybersecurity supply chain risk management C-SCRM:

Cross-functional team responsible for supply chain risk management (SCRM) and C-SCRM
Validating standard risk management with respect to supply chain
- FARM (Frame, Assess, Respond, and Monitor)
- Tasks outlined in NIST Pub 800-161

3.11.7E SCRM Planning (rev 3 withdrawn, moved to other controls)

This is discussed in topic 3.11.6E

3.12.1E Penetration Testing

Validate the organization is progressing through standardized Penetration Testing Protocols.

Evaluate Penetration Test reports for completeness and scope.

Attendees to TN-911: Cyber Threat Intelligence (CTI) Analysis and 800-172 Seminar will receive TechNow approved course materials and expert instruction.

Seminar Duration: 1 day (more upon request)

Seminar Objectives:

Learn to comprehend and develop complex scenarios
Identify and create intelligence requirements through practices such as threat modeling
Utilize threat modeling to drive intelligence handling and practices
Breakdown tactical, operational, and strategic-level threat intelligence
Generate threat intelligence to detect, respond to, and defeat focused and targeted threats
How to collect adversary information creating better value CTI
How to filter and qualify external sources, mitigating low integrity intelligence
Create Indicators of Compromise (IOCs) in STIX
Move security maturity past IOCs into understanding and countering the behavioral tradecraft of threats
Breaking down threats mapped against their tradecraft to tweak IOCs
Establish structured analytical techniques to be successful in any security role
Learn and apply structured principles in support of CTI and how to communicate that to any security role.

Seminar Prerequisites:

Security+, or equivalent experience

CT-325: Security+

Course Overview:

The CT-325: Security+ (SY0-701) class is the primary class you will need to take if your job responsibilities include securing network services, network devices, and network traffic. It will also help you prepare for the CompTIA Security+ examination (exam number SY0-701). In the CT-325: Security+ class you’ll build on your knowledge and professional experience with computer hardware, operating systems, and networks as you acquire the specific skills required to implement basic security services on any type of computer network. Let us help you prepare for the CompTIA Security+ exam (SY0-701).

TechNow is a CompTIA partner and uses official CompTIA Security+ curriculum.

Attendees to CT-325: Security+ will receive TechNow approved course materials and TechNow expert instruction.

Dates/Locations:

Date/Time	Event
09/21/2026 - 09/25/2026 08:00 -16:00	CT-325: Security+ TechNow, Inc, San Antonio TX
11/16/2026 - 11/20/2026 08:00 -16:00	CT-325: Security+ TechNow, Inc, San Antonio TX

Duration: 5 Days

Course Objectives:

Compare and contrast attacks
Compare and contrast security controls
Use security assessment tools
Explain basic cryptography concepts
Implement a public key infrastructure
Implement identity and access management controls
Manage access services and accounts
Implement a secure network architecture
Install and configure security appliances
Install and configure wireless and physical access security
Deploy secure host, mobile, and embedded systems
Implement secure network access protocols
Implement secure network applications
Explain risk management and disaster recovery concepts
Describe secure application development concepts
Explain organizational security concepts

Prerequisites:

CompTIA A+ and Network+ certifications, or equivalent knowledge.
Windows 7/8/10 and Server 2008/2012/2016 experience required.
Six to nine months experience in networking, including experience in configuring & managing TCP/IP.

Comments

Latest comments from students

User: joshjepsen@hotmail.com

Instructor comments: Instructor was very knowledgeable on all the course content. There were some instances when I felt he streamlined through some of the material too quickly, such as going over how to identify types of attacks.

Liked the class? Then let everyone know!

Privacy Policy

Effective Date: August 1, 2026

TechNow, Inc. respects the privacy of our students and visitors to our website and is committed to protecting the information entrusted to us.

This Privacy Policy explains what information we collect, how we use it, how we protect it, and the circumstances under which it may be disclosed.

1. Information We Collect

We may collect information necessary to provide and administer our educational courses and related services.

This information may include:

Name
Mailing or billing address
Telephone or mobile phone number
Email address
Course enrollment information
Student account information
Course progress and quiz activity
Information necessary to process course registration and payment
Communications between the student and our organization concerning course administration

We collect only information that is reasonably necessary to operate our courses, administer student accounts, communicate with students, and provide related services.

2. How We Use Student Information

We use student information solely for legitimate business and educational purposes related to the delivery and administration of our courses.

This may include:

Registering students for courses
Creating and maintaining student accounts
Providing access to course materials and quizzes
Communicating course schedules and changes
Sending course reminders and administrative notifications
Communicating logistical information necessary for a course
Communicating urgent or emergency information related to the delivery of a course
Responding to student questions and requests
Administering payments and registrations
Maintaining records necessary to operate our business and educational programs
Providing technical support for our student platform
Protecting the security and integrity of our systems

3. No Sale or Marketing Use of Student Contact Information

We do not sell, rent, lease, or otherwise provide student telephone numbers, mobile phone numbers, email addresses, or other student contact information to third parties for their own marketing, advertising, lead generation, or sales purposes.

We do not use student contact information to conduct unrelated marketing campaigns.

We do not sell or exchange student contact information for leads, affiliate marketing, or other commercial marketing purposes.

Our communications with students are limited to information reasonably related to their enrollment, courses, student accounts, course logistics, and urgent or emergency matters associated with delivering a course.

4. SMS Text Messaging

Student SMS Notifications

We may use SMS text messaging to communicate with students who have student accounts associated with our courses.

We only take registrations over the phone and when asked for a preferred phone number you were asked: “Would you like to receive course-related text messages at this mobile number?” This is to initiate automated communications. Once logged into the TechNow Quiz Platform there is a button at the top of your dashboard “SMS: on“, with a mouse hover text tooltip of “You are currently enrolled to receive SMS notifications about your student account and courses. PRESS TO DISABLE SMS”. If you press the button it becomes “SMS: off“, with a mouse hover text tooltip of “You are currently NOT enrolled to receive SMS notifications about your student account and courses. PRESS TO ENABLE SMS”. Changes of “SMS: off” and “SMS:on” are logged as text messaging Opt-Out and Opt-in.

SMS messages are used for course-related and administrative communications, not marketing or promotional campaigns. Most TechNow communications is through email, SMS is used for time critical and emergency communications.

Examples of SMS communications may include:

Student account notifications
Course enrollment or welcome notifications
Course reminders
Class schedule information
Schedule changes
Class cancellations
Location or logistical information
Instructor or course-related administrative notifications
Urgent or emergency information related to the delivery of a course
Other communications reasonably necessary to administer a student’s participation in a course

We do not use student SMS messaging to send advertising, promotional offers, sales messages, or unrelated marketing communications.

SMS Consent

Students who elect to receive SMS messages authorize TechNow, Inc. to send course-related and administrative text messages to the mobile telephone number provided by the student.

SMS consent is not a condition of purchasing or enrolling in a course.

Message frequency varies depending on course enrollment, account activity, and circumstances requiring course-related communication. Message and data rates may apply.

Opting Out of SMS Messages

Students may disable SMS notifications through the SMS settings available within their student dashboard.

Students may also reply STOP to an SMS message to request that SMS messaging be discontinued.

After an SMS opt-out request is received, our platforms prevent additional SMS messages from being sent to that telephone number.

A student may request assistance regarding SMS messaging by replying HELP where supported or by contacting us using the contact information provided on our website.

Disabling SMS notifications does not prevent a student from accessing their student account or participating in a course. Students who disable SMS may still receive important information through other available communication methods when necessary.

SMS Information Is Not Sold or Shared for Marketing

We do not sell, rent, or share mobile telephone numbers or SMS consent information with third parties for their own marketing or advertising purposes.

SMS consent information is used solely for administering our student communication program and providing the course-related communications described in this Privacy Policy.

5. TechNow Does NOT Share Information With Service Providers

Unlike most companies, TechNow does not use third-party service providers to operate our business, we are a SELF HOSTED company.

For example, we internally self host:

Website
Student-platform
Email
Information technology and security
Database and infrastructure services

TechNow interacts with a Bank for Payment Processing and with a trusted SMS provider for SMS delivery. A student’s mobile telephone number and message information may be transmitted through our trusted SMS service provider solely to deliver the requested or authorized course-related communication.

6. Course Platform Information

Students may receive an account on our course and quiz platform.

Information associated with a student account may include:

Login credentials
Course enrollment
Quiz and assessment activity
Course progress
Account settings
Communication preferences
SMS preferences

This information is used to provide and administer the student’s courses and account.

7. Payment Information

When payment is required for a course, payment information may be processed through a third-party payment processor.

We do not retain payment-card information on our student quiz platform unless specifically stated otherwise.

Payment processors may collect and process payment information according to their own privacy policies and security practices.

8. Cookies and Technical Information

Our website and student platform may use cookies, session information, logs, and similar technical mechanisms necessary to:

Maintain authenticated sessions
Keep students logged into their accounts
Provide website and application functionality
Maintain security
Detect and prevent unauthorized access
Diagnose technical problems
Improve the reliability of our services

We do not use student contact information for third-party advertising or behavioral marketing.

9. Information Security

We take reasonable administrative, technical, and organizational measures to protect student information against unauthorized access, alteration, disclosure, or destruction.

No method of storing or transmitting information over the Internet can be guaranteed to be completely secure. We therefore cannot guarantee absolute security of information.

10. Retention of Information

We retain student information for as long as reasonably necessary to provide our services, administer courses and student accounts, maintain appropriate business records, comply with legal or regulatory obligations, resolve disputes, and protect our rights and systems.

When information is no longer reasonably necessary for these purposes, we may securely delete or otherwise dispose of it.

11. Children’s Privacy

Our courses and services are intended for the individuals described by our course enrollment requirements. We do not knowingly collect personal information from children in violation of applicable law.

If you believe that a child has provided personal information to us without appropriate authorization, please contact us.

12. Third-Party Websites

Our website may contain links to websites or services operated by third parties.

We are not responsible for the privacy practices, content, or security of third-party websites. We encourage users to review the privacy policies of those websites before providing personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, business practices, or legal requirements.

When we make changes, we will update the Effective Date shown at the beginning of this Privacy Policy.

14. Contact Us

If you have questions about this Privacy Policy, your personal information, or our SMS messaging practices, please contact us:

TechNow Inc.
14117 Jones Maltsberger Rd
San Antonio, TX 53578
210 733-1093
technow-training@technow.com
technow.com

Effective Date: August 1, 2026

TN-965 Windows Security Automation with Powershell

Course Overview:

PowerShell is made for Security Operations (SecOps) automation on Windows. SecOps requires automation in order to scale out security changes and monitoring beyond a handful of hosts. For example, when a vulnerability must be remediated but there is no patch for it yet, automation is needed to quickly and consistently enact the changes necessary. PowerShell “remoting” is encrypted remote command execution of PowerShell scripts in a way that can scale to thousands of endpoints and servers.

Imagine being able to hunt for indicators of compromise across thousands of machines with just a few lines of PowerShell code. Or imagine having the local Administrator account password reset every night on thousands of endpoints in a secure way, and being able to retrieve that password securely too.

We will show you to do these tasks and more. Transcription logging for forensics, strong encryption code signing, application whitelisting of scripts, IPSec port control, and Just Enough Admin (JEA).

As more and more of our systems are moved up to the cloud, PowerShell will become even more important. Amazon Web Services, Microsoft Azure, Office 365, Hyper-V and VMware already support PowerShell administration for many tasks.

Attendees to TN-965: Windows Security Automation with PowerShell will receive TechNow approved course materials and expert instruction.

Date/Locations:

Date/Time	Event
10/26/2026 - 10/30/2026 08:00 -16:00	TN-965 Windows Security Automation with Powershell TechNow, Inc, San Antonio TX

Duration: 5 days

Intended Audience
This course is intended for IT Professionals already experienced in general Windows Server and Windows Client administration or already experienced in administering and supporting Application servers and services including applications like Exchange, SharePoint, and SQL. It is broadly intended for students who want to use Windows PowerShell to automate administrative tasks from the command line, using any Microsoft or independent software vendor (ISV) product that supports Windows PowerShell manageability.

Course Objectives:

PowerShell Overview and Tips

- Getting started running commands
- Using and updating the built-in help
- Execution policies
- Fun tricks with the ISE graphical editor
- Piping .NET and COM objects, not text
- Using properties and methods of objects
- Helping Linux admins feel more at home
- Aliases, cmdlets, functions, modules, etc.
- Customizing your profile script

What Can We Do With PowerShell

- PowerShell remote command execution
- Fan-out remoting and security
- File copy via PowerShell remoting
- Capturing the output of commands
- Parsing text files and logs with regex patterns
- Searching remote event logs faster with XPath
- Mounting the registry as a drive
- Exporting data to CSV, HTML and JSON files
- Parsing and mining nmap port scanner XML output
- Running scripts as scheduled jobs
- Pushing out scripts through Group Policy
- Importing modules and dot-sourcing functions
- http://www.PowerShellGallery.com

Write your own scripts

- Writing your own functions
- Passing arguments into your scripts
- Function parameters and returning output
- Flow control: if-then, do-while, foreach, switch
- The .NET Framework class library: a playground
- How to pipe data in/out of your scripts

Continuous Secure Configuration Enforcement

- How to use Group Policy and PowerShell together
- Automate with INF security templates
- How to customize INF templates
- Microsoft Security Compliance Manager (SCM)
- SECEDIT.EXE scripting
- Building an in-house security repository for SecOps/DevOps
- NSA’s Secure Host Baseline GPOs

Group Policy Precision Targeting

- Managing Group Policy Objects (GPOs) with PowerShell
- LSDOU, Block Inheritance, Enforced GPOs
- Group Policy permissions for targeting changes
- ADMX templates for mass registry editing
- Deploying PowerShell startup and logon scripts
- WMI item-level targeting of GPO preferences
- GPO scheduled tasks to run PowerShell scripts
- Remote command execution via GPO (not remoting)
- Empowering the Hunt Team to fight back!

Server Hardening for SecOps/DevOps

- Server Manager scripting with PowerShell
- Adding and removing roles and feature
- Remotely inventory roles, features, and apps
- Why Server Nano or Server Core
- Running PowerShell automatically after service failure
- Service account identities, passwords, and risks
- Tools to reset service account passwords securely

PowerShell Desired State Configuration (DSC)

- DSC is Configuration Management built in for free
- Using DSC for continuous reinforcement of settings
- Writing your own DSC configuration scripts
- Free DSC resource modules: www.PowerShellGallery.com
- How to push DSC configurations to many targets
- DSC background job processing in push mode
- Examples: sync files, install roles, manage groups
- Auditing a remote target against a DSC MOF template
- “ApplyAndAutoCorrect” mode for continuous enforcement

PowerShell Just Enough Admin (JEA)

- JEA is Windows sudo, like on Linux
- JEA is Windows setuid root, like on Linux
- Restricting commands and arguments
- Verbose transcription logging
- How to set up and configure JEA
- Privilege Access Workstations (PAWs)

PowerShell and WMI

- Windows Management Instrumentation (WMI) service
- What is WMI and why do hackers abuse it so much?
- Using PowerShell to query WMI CIM classes
- WMI authentication and traffic encryption
- Inventory operating system versions and installed software
- WMI remote command execution versus PowerShell remoting
- PowerShell security best practices
- PowerShell transcription logging to catch hackers

Prerequisites:

Previous Windows Server and Windows Client management knowledge and hands on experience.
Experience installing and configuring Windows Server into existing enterprise environments, or as standalone installations.
Knowledge and experience of network adapter configuration, basic Active Directory user administration, and basic disk configuration.
Knowledge and hands on experience specifically with Windows Server 2012/Windows Server 2012 R2 and Windows 8/Windows 8.1 would be of benefit but is not essential.

Comments

Latest comments from students