Unit 1: Tier-2 Foundations — Enterprise Telemetry, Normalization, ATT&CK Deep & D3FEND
Tier-2 Foundations — Enterprise Telemetry, Normalization, ATT&CK Deep & D3FEND — Blue Ascent.
1.1 From Tier-1 Triage to Tier-2 Investigation
Labs
Course Content
1.2 Enterprise Telemetry & Normalization
Labs
Course Content
1.3 ATT&CK Deep, D3FEND & Coverage
Labs
Course Content
Unit 2: SIEM Investigations I — Microsoft Sentinel & KQL Hunting
SIEM Investigations I — Microsoft Sentinel & KQL Hunting — Blue Ascent.
2.1 Sentinel Incidents & KQL Foundations for Investigation
Labs
Course Content
2.2 KQL Hunting & Entity Investigation
Labs
Course Content
Unit 3: SIEM Investigations II — Splunk ES, SPL, CIM & Risk-Based Alerting
SIEM Investigations II — Splunk ES, SPL, CIM & Risk-Based Alerting — Blue Ascent.
3.1 SPL for Investigations & the CIM
Labs
Course Content
3.2 Enterprise Security Notables & Risk-Based Alerting
Labs
Course Content
Unit 4: SIEM Investigations III — Elastic Security (EQL) & IBM QRadar
SIEM Investigations III — Elastic Security (EQL) & IBM QRadar — Blue Ascent.
4.1 Elastic Security
Labs
Course Content
4.2 IBM QRadar
Labs
Course Content
Unit 5: EDR/XDR Investigations & Containment
EDR/XDR Investigations & Containment — Blue Ascent.
5.1 The EDR Investigation Workflow
Labs
Course Content
5.2 Response, Containment & Cross-Domain Correlation
Labs
Course Content
Unit 6: Deep Windows Event, Sysmon & PowerShell Analysis
Deep Windows Event, Sysmon & PowerShell Analysis — Blue Ascent.
6.1 Process & Execution Reconstruction
Labs
Course Content
6.2 Logon, Session & PowerShell Analysis
Labs
Course Content
6.3 Persistence & Host Timeline
Labs
Course Content
Unit 7: Deep Linux Logging & Investigations (auditd/journald)
Deep Linux Logging & Investigations (auditd/journald) — Blue Ascent.
7.1 Linux Auth, Journald & Command Recovery
Labs
Course Content
7.2 auditd & Linux Persistence
Labs
Course Content
Unit 8: Detection Engineering — Sigma, YARA & Detection Tuning
Detection Engineering — Sigma, YARA & Detection Tuning — Blue Ascent.
8.1 Detection-as-Code with Sigma
Labs
Course Content
8.2 Behavioral & Malware Detection
Labs
Course Content
8.3 Tuning & False-Positive Reduction
Labs
Course Content
Unit 9: Active Directory & Authentication Investigations
Active Directory & Authentication Investigations — Blue Ascent.
9.1 AD & Kerberos Investigations
Labs
Course Content
9.2 Cloud Identity & Authentication
Labs
Course Content
Unit 10: Lateral Movement & Persistence Detection
Lateral Movement & Persistence Detection — Blue Ascent.
10.1 Lateral Movement Detection
Labs
Course Content
10.2 Persistence Detection & Movement Graph
Labs
Course Content
Unit 11: Email, Network & Intermediate Malware Investigations
Email, Network & Intermediate Malware Investigations — Blue Ascent.
11.1 Email Investigations (Deep)
Labs
Course Content
11.2 Network & Web Investigations
Labs
Course Content
11.3 Intermediate Malware Triage
Labs
Course Content
Unit 12: Threat Intelligence Integration & ATT&CK-Driven Hunting
Threat Intelligence Integration & ATT&CK-Driven Hunting — Blue Ascent.
12.1 Operationalizing Intelligence
Labs
Course Content
12.2 Intel-Driven & TTP Hunting
Labs
Course Content
Unit 13: DFIR Workflows — Triage Collection, Artifacts, Memory & Timelining
DFIR Workflows — Triage Collection, Artifacts, Memory & Timelining — Blue Ascent.
13.1 Triage Collection & Windows Artifacts
Labs
Course Content
13.2 Memory Triage & Timelining
Labs
Course Content
Unit 14: Cloud SOC Fundamentals + Case Management, Alert Prioritization & Detection Quality
Cloud SOC Fundamentals + Case Management, Alert Prioritization & Detection Quality — Blue Ascent.
14.1 Cloud SOC Investigations & IR
Labs
Course Content
14.2 Case Management, Prioritization & Detection Quality
Labs
Course Content
Unit 15: Capstone — Operation Cobalt Ledger — End-to-End Enterprise Intrusion at Nimbus Financial
Capstone — Operation Cobalt Ledger — End-to-End Enterprise Intrusion at Nimbus Financial — Blue Ascent.