Here are the learning objectives for the course:

• Understand Incident Response and Security Operations: Gain a solid foundation in incident response procedures, security operations best practices, and the tools used to detect and respond to threats.
• Master Key Blue Team Tools: Learn about the top 20 open-source tools every blue teamer should have, and how to effectively use them for threat detection and defense.
• Deploy and Configure SIEM Systems: Acquire hands-on experience with deploying the Elastic Stack (ELK) SIEM and Microsoft Azure Sentinel, and learn how to set up cloud-native SIEM and SOAR solutions.
• Implement Host-based Intrusion Detection: Set up and configure Wazuh for host-based intrusion detection to monitor and secure endpoints in real-time.
• Develop Threat Intelligence Skills: Understand the fundamentals of threat intelligence, and learn how to integrate threat feeds and intelligence into your security operations.
• Effectively Use Incident Management Systems: Learn how to install and use The Hive Project for efficient incident management and response coordination.
• Conduct Threat Hunting and Incident Response with OSQuery: Use OSQuery and Kolide Fleet to hunt for threats, investigate anomalies, and respond to incidents.
• Enhance Reconnaissance with MITRE PRE-ATT&CK: Understand how to leverage the MITRE PRE-ATT&CK framework to enhance reconnaissance efforts and improve threat assessments.
• Perform Open Source Intelligence (OSINT): Gain expertise in using SpiderFoot and Shodan to perform OSINT and gather valuable data for security investigations.
• Defend Against APTs with MITRE ATT&CK: Learn how to use the MITRE ATT&CK framework to defend against advanced persistent threats (APTs) and identify attack patterns.
• Analyze Malicious Traffic: Gain hands-on experience analyzing malicious traffic using Wireshark, and develop the skills to identify and mitigate network-based attacks.
• Master Digital Forensics: Understand the fundamentals of digital forensics, including how to collect and analyze digital evidence during an investigation.
• Perform Static Malware Analysis: Learn how to perform static malware analysis using Radare2, focusing on dissecting malware samples without executing them.

To get the most out of this course, participants should have a basic understanding of networking, cybersecurity concepts, and the use of computers in a professional environment. While prior experience with security tools is not required, the following will help:

• Basic knowledge of networking protocols (TCP/IP, DNS, HTTP, etc.)
• Familiarity with operating systems (Windows, Linux)
• Understanding of cybersecurity fundamentals (threats, vulnerabilities, defenses)
• Basic experience with command-line interfaces
• Equipment Needed:
• For the hands-on portions of the course, you will need the following:
• A Computer: A laptop or desktop capable of running virtual machines or containerized environments. We will be using tools that require sufficient processing power and memory (minimum of 8GB RAM recommended).
• Virtualization Software: Software like VMware, VirtualBox, or Hyper-V to run virtual machines for various security tools and environments.
• Internet Access: A stable internet connection to download software, access course materials, and engage with cloud-based services.
• Software/Tools:
• Elastic Stack (ELK), Azure Sentinel, Wazuh, OSQuery, Kolide Fleet, Wireshark, The Hive Project, Radare2, SpiderFoot, and Shodan (we will provide detailed installation instructions).
• Wireshark: For traffic analysis and packet capture.
• A Linux environment (VM or native) is recommended for some exercises involving command-line tools and analysis.