SANS – SEC503: Network Monitoring and Threat Detection In-Depth 2021-6

SEC503: Network Monitoring and Threat Detection In-Depth. This course is a comprehensive, specialized training that provides the skills necessary to defend traditional and cloud networks. This course provides you with the theoretical foundations of TCP/IP and key protocols, enabling you to effectively analyze network traffic. The course’s unique, bottom-up approach teaches you how and why network protocols work, and then applies this knowledge directly to identifying emerging (zero-day) threats and reconstructing attacks. Unlike courses that focus solely on how to use specific tools, SEC503 provides an in-depth understanding of what’s really going on in your network pipeline. You’ll learn how to extend the threat detection capabilities of common tools, analyze incidents, and hunt for threats effectively. Described as the most challenging yet rewarding course in the information security career path, this course directly prepares you for the prestigious GCIA (Certified Penetration Analyst) certification and is designed for professionals who want to go beyond typical alerts and uncover hidden threats in their network.

What you will learn

• Traffic Analysis: You will learn how to analyze traffic to identify threats and anomalies.
• Detect zero-day threats: You detect zero-day threats using advanced techniques.
• Configure and adjust network security tools: You configure and adjust network security tools.
• Network Cybercrime Investigation: You perform Network Forensics to reconstruct events.
• Traffic Understanding: You understand and distinguish between normal and abnormal traffic.
• Develop threat models: You develop threat models to enhance detection capabilities.
• Practical Skills Practice: You practice practical skills through real-life scenarios.
• Learning Tools: You will learn how to work with various tools including tcpdump, Wireshark, Snort, Suricata, Zeek, tshark, SiLK, and NetFlow/IPFIX.

This course is suitable for people who:

• Network, System, and Security Operations Center Monitoring Analysts: Analysts gain familiarity or become more proficient using traffic analysis tools to monitor networks and identify threats in cloud and traditional environments.
• Network Engineers/Administrators: Network engineers and administrators will understand the importance of optimal placement of network monitoring sensors and how to use network cybercrime investigation data such as log data and network flow data to enhance threat detection capabilities.
• Operational Security Managers: Operational Security Managers will understand the complexities of network monitoring and assist analysts by providing the resources necessary for success.