• Online, Instructor-Led
Course Description

Sophisticated attackers frequently go undetected in a victim’s network for an extended period. Attackers can blend their traffic with legitimate traffic that only skilled network analysts know how to detect. This course shows learners how to identify malicious network activity. The course provides an overview of network protocols, network architecture, intrusion detection systems, network traffic capture and traffic analysis. Learners review the types of network monitoring and the tools commonly used to analyze captured network traffic. The course also explores the best techniques for investigating botnets and how to use honeypots in network monitoring.

Learning Objectives

After completing the course, learners should be able to: • Understand the network monitoring and incident response processes, and why it’s critical in today’s network environments • Discuss the pros and cons of statistical, connection, full content and event monitoring and tools • Perform event-based monitoring using Snort • Minimize network traffic with the Snort rule structure and custom rule creation • Review Snort alerts using the Sguil front end

Framework Connections

The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):

Specialty Areas

  • Incident Response

Specialty Areas have been removed from the NICE Framework. With the recent release of the new NICE Framework data, updates to courses are underway. Until this course can be updated, this historical information is provided to give better context as to how it can help you with your cybersecurity goals.