Security Analyst Course

Lesson 1 • The Security Analyst Role

Defines analyst responsibilities, career tiers, and daily workflows. Establishes professional context before technical content is introduced.

Lesson 2 • Networking Fundamentals for Analysts

Reviews TCP/IP, DNS, HTTP, and common protocols analysts encounter daily. Enables accurate traffic interpretation in later monitoring chapters.

Lesson 3 • Core Cybersecurity Concepts

Covers the CIA triad, authentication models, and basic cryptography. Provides the vocabulary needed for all subsequent technical chapters.

Lesson 4 • Operating System Security Basics

Introduces Windows and Linux security features, user permissions, and logging. Prepares analysts to investigate host-based evidence.

Lesson 1 • Writing Effective Detection Rules

Teaches rule logic, threshold tuning, and correlation queries. Directly enables alert creation covered in the next section.

Lesson 2 • Alert Triage and Prioritization

Covers alert severity scoring, triage workflows, and escalation criteria. Builds the decision-making foundation for incident response.

Lesson 3 • Log Sources and Collection Methods

Identifies critical log sources including firewalls, endpoints, and applications. Establishes what data feeds into a monitoring pipeline.

Lesson 4 • SIEM Platforms and Configuration

Explains SIEM architecture, data ingestion, and normalization. Analysts learn to configure parsers and manage log pipelines.

Lesson 1 • Packet Capture Fundamentals

Introduces capture tools, filter syntax, and capture file formats. Provides the technical baseline for all traffic analysis tasks.

Lesson 2 • Protocol Dissection and Inspection

Examines HTTP, DNS, SMB, and TLS traffic at the packet level. Enables analysts to distinguish normal from suspicious protocol behaviour.

Lesson 3 • Intrusion Detection System Tuning

Teaches IDS/IPS rule management, signature updates, and performance tuning. Ensures detection infrastructure remains accurate and efficient.

Lesson 4 • Detecting Network-Based Attacks

Applies protocol knowledge to identify scans, lateral movement, and exfiltration. Bridges traffic analysis skills to real attack scenarios.

Lesson 1 • Endpoint Containment and Remediation

Teaches host isolation, artifact removal, and recovery validation. Connects detection findings to actionable response steps.

Lesson 2 • Process and Memory Analysis

Covers process tree inspection, memory artifact identification, and injection detection. Builds skills for detecting fileless and in-memory threats.

Lesson 3 • Persistence Mechanism Detection

Identifies registry-based, scheduled task, and service persistence techniques. Ensures analysts can find attacker footholds on compromised hosts.

Lesson 4 • Endpoint Telemetry and EDR Platforms

Surveys EDR agent architecture, telemetry types, and deployment models. Establishes the data foundation for host-based investigations.

Lesson 1 • Adversary Profiling with MITRE ATT&CK

Applies the ATT&CK framework to map adversary TTPs and coverage gaps. Directly informs detection rule development and hunt priorities.

Lesson 2 • Indicator of Compromise Management

Covers IOC types, ingestion pipelines, and indicator lifecycle management. Enables automated enrichment of alerts with threat context.

Lesson 3 • Threat Intelligence Platforms

Examines TIP architecture, feed integration, and analyst workflows. Connects raw intelligence data to operational detection use cases.

Lesson 4 • Threat Intelligence Fundamentals

Defines intelligence types, the intelligence cycle, and analyst use cases. Provides the conceptual framework for all intelligence-driven activities.

Lesson 1 • Communicating Vulnerability Risk

Guides analysts in translating technical findings into business risk language. Supports executive reporting and remediation prioritisation decisions.

Lesson 2 • Remediation Tracking and Verification

Teaches patch management integration, exception handling, and rescan validation. Connects vulnerability findings to measurable risk reduction.

Lesson 3 • Vulnerability Scoring and Prioritization

Applies CVSS, exploitability data, and asset criticality to rank findings. Ensures remediation effort targets the highest-risk vulnerabilities first.

Lesson 4 • Vulnerability Management Lifecycle

Defines discovery, assessment, prioritisation, remediation, and verification phases. Frames all scanning and tracking activities within a repeatable process.

Lesson 1 • Incident Response Lifecycle

Maps the preparation, detection, containment, eradication, and recovery phases. Provides the procedural backbone for all response activities.

Lesson 2 • Post-Incident Review and Improvement

Guides analysts through after-action reviews, root cause analysis, and control improvements. Closes the response loop with measurable security gains.

Lesson 3 • Coordinating Cross-Team Response

Addresses communication protocols, stakeholder roles, and external coordination. Prepares analysts to operate within larger incident response teams.

Lesson 4 • Case Management and Documentation

Covers ticketing systems, evidence chain of custody, and timeline construction. Ensures investigations are reproducible and legally defensible.

Lesson 1 • Measuring and Improving Detection Coverage

Uses ATT&CK coverage mapping, purple team exercises, and metrics to assess gaps. Drives continuous improvement of the detection programme.

Lesson 2 • Threat Hunting Methodology

Introduces hypothesis-driven hunting, data source selection, and hunt planning. Establishes the structured approach that separates hunting from reactive monitoring.

Lesson 3 • Behavioural Detection and Analytics

Applies UEBA, machine learning signals, and behavioural baselines to detection. Extends rule-based detection with anomaly-driven approaches.

Lesson 4 • Detection Engineering Principles

Defines detection-as-code, rule quality standards, and testing frameworks. Elevates detection from ad hoc rules to engineered, maintainable content.