EC-Council CSA Boot Camp

Explain the overall SOC purpose to the organization and which internal processes belong to which functions
Describe the role of SOC analyst tiers within the other roles and processes within the organization
Explain how the SOC analyst contributes and applies security policies to the organization
Select SOC analyst-appropriate tools and/or processes based on the type of task required by the business scenario

Given a scenario within the threat landscape, identify common attack techniques and profiles that target common vulnerabilities
Perform threat research and compare popular online vulnerability and blogs and databases
Establish a known-good network baseline
Validate the known-bad to a known-good baseline

Describe the purpose of logs, log generating events, and use of logs in relation to prevent, detect, and respond
Describe how alerts are triggered by incidents and logs are used to correlate those incidents
Locate network device logs and compare common data found in logs from firewalls, IDS/IPS, UTMs, and NTA, including their actual data fields
Contrast data fields found in logs from Linux and Windows systems, including registry and other local databases
Configure alert triggers and filters in devices and applications to avoid false positives
Use analysis techniques with log viewers and tools to detect symptoms of phishing, DoS/DDoS, injection, hijacking, malware communication, and authentication attack events
Use custom plugins and bash/Powershell scripting to automate large-scale analysis of log files
Create basic Python scripts used to automate tasks and correlate relevant data

Describe the purpose and application of SIEM
Analyze SIEM results and correlate multiple events in enterprise security incidents across network devices and traffic
Using tools like Splunk to detect evidence of post-attack strategies such as APT, lateral movement, data exfiltration, and anti-forensics

Use protocol analyzers to capture live traffic on different network segments
Filter packet capture by protocol, source, destination, and other fields
Use analysis techniques with packet analyzers to detect symptoms of phishing, DoS/DDoS, injection, hijacking, malware communication, and authentication attack events
Export packet captures and other analyzable reporting formats

Given a scenario, determine which phase of incident response operation it describes, including reporting and brief templates
Determine IOC identification, initial point of compromise identification, scoping methods and containment strategies, eradication and remediation actions for a given type of incident
Identify incident scoping measure strategies and indicators of compromise use in incident response operations
Given malware or adversary tools, identify methods for eradication of malware or adversary tools, and restoration and remediation activities