Security Monitoring Course

Lesson 1 • Threat Landscape Overview

Surveys attacker categories, motivations, and common attack patterns. Provides context for why specific monitoring controls are prioritised.

Lesson 2 • Security Monitoring Concepts and Goals

Defines security monitoring, its objectives, and its relationship to risk management. Establishes shared vocabulary used throughout the course.

Lesson 3 • Regulatory and Compliance Drivers

Covers compliance frameworks and audit requirements that shape monitoring programmes. Links regulatory obligations to practical logging and alerting decisions.

Lesson 1 • Log Integrity and Retention

Covers tamper-evident logging, chain of custody, and retention policies. Ensures log data remains trustworthy and available for investigations.

Lesson 2 • Log Sources and Data Types

Identifies critical log sources across network, endpoint, and application layers. Establishes which data types are essential for effective detection.

Lesson 3 • Log Pipeline Troubleshooting

Diagnoses common collection failures, gaps, and data quality issues. Builds operational confidence in maintaining a healthy log pipeline.

Lesson 4 • Log Collection Architectures

Compares agent-based, agentless, and syslog collection methods. Guides students in selecting architectures suited to their environment.

Lesson 1 • SIEM Architecture and Core Components

Explains SIEM ingestion pipelines, indexing, and storage layers. Grounds students in how data flows from source to analyst interface.

Lesson 2 • Dashboards and Visualisations

Guides creation of operational dashboards using charts, tables, and maps. Effective visualisations accelerate situational awareness during monitoring shifts.

Lesson 3 • Aggregation and Statistical Analysis

Covers grouping, counting, and statistical functions within SIEM queries. Transforms raw events into summarised views that reveal patterns.

Lesson 4 • Search Query Language Basics

Introduces query syntax, field filtering, and time-range selection. Enables analysts to retrieve precise datasets from large log volumes.

Lesson 1 • Rule Testing and Validation

Teaches unit testing, replay testing, and red-team validation of detection rules. Validated rules provide confidence before production deployment.

Lesson 2 • Detection Logic Fundamentals

Introduces threshold, signature, and behavioural detection approaches. Establishes the logic types analysts use to translate threats into rules.

Lesson 3 • Threat Intelligence Integration

Explains how to enrich rules with indicators of compromise and threat feeds. Intelligence-driven rules improve precision and reduce analyst workload.

Lesson 4 • Writing Effective Alert Rules

Covers rule syntax, condition chaining, and suppression logic. Well-structured rules reduce noise while maintaining detection sensitivity.

Lesson 1 • Flow Data Analysis

Teaches NetFlow, IPFIX, and sFlow analysis for high-level traffic visibility. Flow data enables detection without full packet capture overhead.

Lesson 2 • Network Monitoring Fundamentals

Reviews TCP/IP layers, key protocols, and normal traffic baselines. Baseline knowledge is prerequisite to recognising deviations.

Lesson 3 • Intrusion Detection System Tuning

Explains IDS rule sets, signature updates, and performance tuning. Properly tuned IDS sensors maximise detection with minimal false positives.

Lesson 4 • Encrypted Traffic Analysis

Addresses TLS inspection, JA3 fingerprinting, and metadata-based detection. Enables monitoring of encrypted channels without breaking confidentiality.

Lesson 1 • Persistence and Privilege Escalation

Examines registry run keys, scheduled tasks, and privilege escalation paths. Detecting persistence early limits attacker dwell time.

Lesson 2 • Endpoint Telemetry Sources

Identifies process, file, registry, and network telemetry collected by EDR agents. Rich telemetry is the foundation of effective endpoint detection.

Lesson 3 • EDR Alert Triage and Response

Teaches alert prioritisation, host isolation, and evidence collection workflows. Rapid triage reduces mean time to contain confirmed threats.

Lesson 4 • Malware Behaviour Detection

Covers common malware execution patterns, injection techniques, and evasion tactics. Behavioural signatures catch threats that evade static antivirus.

Lesson 1 • Incident Classification and Prioritisation

Defines incident severity levels, impact criteria, and escalation thresholds. Consistent classification ensures resources are allocated to the highest-risk events.

Lesson 2 • Root Cause Analysis

Applies structured analysis to identify the initial access vector and enabling conditions. Root cause findings drive remediation and prevent recurrence.

Lesson 3 • Evidence Collection and Preservation

Covers volatile and non-volatile evidence collection, chain of custody, and hashing. Proper preservation maintains evidentiary integrity for legal and forensic use.

Lesson 4 • Attack Timeline Reconstruction

Teaches log correlation, artefact pivoting, and timeline visualisation techniques. Accurate timelines reveal attacker actions and scope of compromise.

Lesson 1 • Behavioural Analytics and Baselining

Covers user and entity behaviour analytics, peer grouping, and anomaly scoring. Statistical baselines surface subtle deviations missed by rule-based detection.

Lesson 2 • Adversary Technique Mapping

Applies structured adversary frameworks to map detections to known techniques. Coverage mapping reveals gaps and guides rule development priorities.

Lesson 3 • Measuring Hunt and Detection Effectiveness

Defines metrics for hunt productivity, detection coverage, and mean time to detect. Measurement enables continuous improvement of the monitoring programme.

Lesson 4 • Threat Hunting Methodology

Introduces hypothesis-driven hunting, maturity models, and hunt planning. A structured methodology transforms ad hoc searching into repeatable practise.