Discuss best practices for responding to Azure, M365, and AWS cloud platforms.Collect host- and cloud-based forensic data from large environments.Deploy collaboration and analysis platforms that allow teams to work across rooms, states, or countries simultaneously.Understand when incident response requires in-depth host interrogation or light-weight mass collection.Students will then dig into analysis methodologies, learning multiple approaches to understand attacker movement and activity across hosts of varying functions and operating systems by using timeline, graphing, structured, and unstructured analysis techniques.įOR608: Enterprise-Class Incident Response & Threat Hunting will teach you to: By using example tools built to operate at enterprise-class scale, students will learn the techniques to collect focused data for incident response and threat hunting. This requires the ability to automate and the ability to quickly focus on the right information for analysis.
The concepts are similar: gathering, analyzing, and making decisions based on information from hundreds of machines. Without the proper tools and methodologies, security teams will always find themselves playing catch-up, and the attacker will continue to achieve success.įOR608: Enterprise-Class Incident Response & Threat Hunting focuses on identifying and responding to incidents too large to focus on individual machines. Our experience has shown that when sizeable organizations suffer a breach, the attackers seldom compromise one or two systems. Although geographic location and network size have not deterred attackers in breaching their victims, these factors present unique challenges in how organizations can successfully detect and respond to security incidents. Enterprises today have thousands maybe even hundreds of thousands - of systems ranging from desktops to servers, from on-site to the cloud.
0 kommentar(er)
