Certified Soc Analyst (CSA)
Overview
The Certified SOC Analyst (CSA) program is the first step to joining a security operations center (SOC). It is engineered for current and aspiring Tier I and Tier II SOC analysts to achieve proficiency in performing entry-level and intermediate-level operations.
CSA is a training and credentialing program that helps the candidate acquire trending and in-demand technical skills through instruction by some of the most experienced trainers in the industry. The program focuses on creating new career opportunities through extensive, meticulous knowledge with enhanced level capabilities for dynamically contributing to a SOC team.
Objectives
- End-to-End SOC workflow.
- Incident Detection with SIEM.
- Incident Detection with Threat Intelligence.
- Understanding of SIEM Deployment.
Audience
- SOC Analysts (Tier I and Tier II).
- Network and Security Administrators, Network and Security Engineers, Network. Defense Analyst, Network Defense Technicians, Network Security Specialist, Network Security Operator, and any security professional handling network security operations.
- Cybersecurity Analyst.
- Entry-level cybersecurity professionals.
- Anyone who wants to become a SOC Analyst.
Outline
- Computer Network Fundamentals.
- TCP/IP Protocol Suite.
- Application Layer Protocols
- Transport Layer Protocols.
- Internet Layer Protocols.
- Link Layer Protocols.
- IP Addressing and Port Numbers.
- Network Security Controls.
- Network Security Devices.
- Windows Security.
- Unix/Linux Security.
- Web Application Fundamentals.
- Information Security Standards, Laws and Acts.
- Security Management.
- Security Operations.
- Security Operations Center (SOC).
- Need of SOC.
- SOC Capabilities.
- SOC Operations.
- SOC Workflow.
- Components of SOC: People, Process and Technology.
- People.
- Technology.
- Processes.Types of SOC Models.
- SOC Maturity Models.
- SOC Generations.
- SOC Implementation.
- SOC Key Performance Indicators (KPI) and Metrics.
- Challenges in Implementation of SOC.
- Best Practices for Running SOC.
- SOC vs NOC.
- Cyber Threats.
- Intent-Motive-Goal.
- Tactics-Techniques-Procedures (TTPs).
- Opportunity-Vulnerability-Weakness.
- Network Level Attacks.
- Host Level Attacks.
- Application Level Attacks.
- Email Security Threats.
- Understanding Indicators of Compromise (IoCs).
- Understanding Attacker’s Hacking Methodology.
- Incident.
- Event.
- Log.
- Typical Log Sources.
- Need of Log.
- Logging Requirements.
- Typical Log Format.
- Logging Approaches.
- Local Logging.
- Centralized Logging
- Security Information and Event Management (SIEM).
- Security Analytics.
- Need of SIEM.
- Typical SIEM Capabilities.
- SIEM Architecture and Its Components.
- SIEM Solution.
- SIEM Deployment.
- Incident Detection with SIEM.
- Examples of commonly Used Use Cases Across all SIEM deployments.
- Handling Alert Triaging and Analysis.
- Understanding Cyber Threat Intelligence.
- Why Threat Intelligence-driven SOC?.
- Incident Response.
- Incident Response Team (IRT).
- Where Does IRT Fits in the Organization?
- SOC and IRT Collaboration.
- Incident Response (IR) Process Overview.
- Responding to Network Security Incidents.
- Responding to Application Security Incidents.
- Responding to Email Security Incidents.
- Responding to an Insider Incidents.
- Responding to Malware incidents.
Exam Facts
| Delivery | Online (Web based) |
| Format | Multiple choice |
| Proctoring | Live |
| Duration | 3 hours |
| # of questions | 100 |
| Pass grade | 70% |
- The CSA exam is designed to test and validate a candidate’s comprehensive understanding of the jobs tasks required as a SOC analyst. Thereby validating their comprehensive understanding of a complete SOC workflow.
Related Certification
- Certified SOC Analyst (CSA)
