After taking this training, you should be able to:

• Explain how a Security Operations Center (SOC) operates and describe the different types of services that are performed from a Tier 1 SOC analyst's perspective
• Explain Network Security Monitoring (NSM) tools that are available to the network security analyst
• Explain the data that is available to the network security analyst
• Describe the basic concepts and uses of cryptography
• Describe security flaws in the TCP/IP protocol and how they can be used to attack networks and hosts
• Understand common endpoint security technologies
• Understand the kill chain and the diamond models for incident investigations, and the use of exploit kits by threat actors
• Identify resources for hunting cyber threats
• Explain the need for event data normalization and event correlation
• Identify the common attack vectors
• Identify malicious activities
• Identify patterns of suspicious behaviors
• Conduct security incident investigations
• Explain the use of a typical playbook in the SOC
• Explain the use of SOC metrics to measure the effectiveness of the SOC
• Explain the use of a workflow management system and automation to improve the effectiveness of the SOC
• Describe a typical incident response plan and the functions of a typical Computer Security Incident Response Team (CSIRT)
• Explain the use of Vocabulary for Event Recording and Incident Sharing (VERIS) to document security incidents in a standard format

This training is designed for individuals seeking a role as an associate-level cybersecurity analyst and IT professionals desiring knowledge in Cybersecurity operations or those in pursuit of the Cisco Certified CyberOps Associate certification including:

• Students pursuing a technical degree
• Current IT professionals
• Recent college graduates with a technical degree

Before taking this training, you should have the following knowledge and skills:

• Familiarity with Ethernet and TCP/IP networking
• Working knowledge of the Windows and Linux operating systems
• Familiarity with basics of networking security concepts

The following Cisco offering can help you gain the knowledge you need to prepare for this training:

• Implementing and Administering Cisco Solutions (CCNA)

Associated Certification: Cisco Certified CyberOps Associate

Associated Exam: 200-201 CBROPS