Course

Threat Investigation

Cisco Learning and Certifications

If you are an associate-level cybersecurity analyst working in security operation centers, the Threat Investigation course by Cisco Learning and Certifications equips you with the essential knowledge and techniques to understand and analyze cyber threats. This comprehensive course covers cyber-threat hunting concepts, hunting maturity models, threat investigation procedures, security monitoring organization, and event correlation and normalization.

Throughout the course, you will gain insights into the use of the Common Vulnerability Scoring System (CVSS), hot threat dashboards, security intelligence feeds, threat analytic systems, and various online security research tools. The curriculum also includes practical exercises and quizzes to reinforce your learning and prepare you for real-world scenarios.

  • Understand cyber-threat hunting concepts and the five hunting maturity levels (HM0–HM4)
  • Describe the hunting cycle four-stage loop and the use of CVSS v3.0 base metrics
  • Utilize publicly available threat awareness resources and external threat intelligence sources
  • Simulate malicious actions for event data analysis and identify resources for hunting cyber threats

Certificate Available ✔

Get Started / More Info
Threat Investigation
Course Modules

The Threat Investigation course modules cover cyber-threat hunting, event correlation and normalization, security incident investigations, and using a playbook model to organize security monitoring.

Identifying Resources for Hunting Cyber Threats

Identifying Resources for Hunting Cyber Threats module provides an introduction to cyber-threat hunting concepts, hunting maturity models, the CVSS, hot threat dashboards, publicly available threat awareness resources, and security intelligence feeds. It also includes practical quizzes and a course exam to assess your knowledge and skills.

Understanding Event Correlation and Normalization

The Understanding Event Correlation and Normalization module delves into event sources, evidence, chain of custody, security data normalization, and event correlation. You will learn about various security data manipulation techniques and gain insights into conducting security incident investigations through practical quizzes and discussions.

Conducting Security Incident Investigations

Conducting Security Incident Investigations module equips you with the procedures and techniques to investigate security incidents effectively. Through a detailed example, you will understand how to analyze and respond to specific threats, enhancing your incident response capabilities.

Using a Playbook Model to Organize Security Monitoring

The Using a Playbook Model to Organize Security Monitoring module introduces security analytics, playbook definition, and the components of a play. It also covers playbook management systems and offers practical quizzes to reinforce your understanding of security monitoring organization.

More Security Courses

IT Fundamentals for Cybersecurity

IBM

This course provides a comprehensive understanding of cybersecurity fundamentals, including tools, processes, network security, and compliance. Gain essential knowledge...

Cyber Threat Hunting

Infosec

Cyber Threat Hunting equips learners with advanced skills in threat hunting methodologies, intelligence gathering, and remediation techniques to proactively defend...

Managing Network Security

University System of Georgia

Managing Network Security is a comprehensive course covering the identification and management of threats to data from internal and external networks, emphasizing...

Understanding ISO Security Standards for Your Organization

Codio

This course provides an introduction to ISO and IEC security standards, focusing on the 27000 series and risk management with ISO 31000. Learners will acquire a...