SEC450: Blue Team Fundamentals: Security Operations and Analysis

Section one introduces core SOC concepts, focusing on aligning SOC goals with organizational needs and threat landscapes. It covers analyst workflows, key tools like SIEMs and threat intelligence platforms, and how they integrate for effective detection and response. Labs include log analysis, query building, dashboard creation, and incident management.

Day two focuses on building a deep understanding of your network for effective defense. We cover network architecture, visibility points, and traffic capture types, followed by an in-depth look at common services like DNS, HTTP, and TLS. The goal is to help analysts recognize normal data, spot anomalies, and identify attacker tactics using everyday services.

Section three covers common endpoint attacks and security controls, with a focus on key Linux and Windows log events. We also explore file structures, teaching students to identify malicious files and understand file signatures, hashes, and formats.

This section focuses on mastering analysis techniques, avoiding biases, and sorting opportunistic from targeted attacks. It teaches alert triage methods, offensive and defensive mental models, and prioritizing alerts. The day also covers cyber defense OPSEC, phishing email investigation, email header analysis, and safe investigation of attachments and URLs.

This section addresses common SOC challenges like repetitive tasks and burnout by focusing on process optimization, analysis design, and efficiency. It aims to improve team engagement by reducing monotonous tasks and allowing analysts to focus on meaningful work. We cover tool tuning, containment techniques, career development, and community involvement.

The course concludes with a day-long, team-based capture-the-flag competition. Using network data and logs from a simulated network attack, day six offers a full day of hands-on experience applying lessons. Teams will be challenged to detect and identify attacks, progressing through various questions to demonstrate mastery of the concepts and data covered.