Cisco CyberOps Associate Training in Beijing

Cisco CyberOps Associate Training Course Outline

Module 1: Network Concepts

• Networking Protocols and Networking Devices
  • What Are Networking Protocols?
  • Common Network Devices
  • Router vs Switch vs Hub
  • Understanding Firewalls and NAT
  • Protocol Encapsulation
  • Real-World Protocol Use Cases
• Layer 2 Fundamentals and Technologies
  • What Is Layer 2 in Networking?
  • MAC Addresses and ARP
  • Layer 2 Switching Logic
  • VLANs and Segmentation
  • Layer 2 Attacks and Mitigation
• Internet Protocol and Layer 3 Technologies
  • What Is IP Addressing?
  • Subnetting in Brief
  • Routing Concepts
  • Static vs Dynamic Routing
  • Static Routing in Cisco Packet Network
  • IP Packet Structure
  • IPv6 Overview
  • Real-World IP Challenges
• Internet Control Message Protocol (ICMP)
  • ICMP Basics
  • Ping and Traceroute Explained
  • ICMP Vulnerabilities
  • ICMP in Security Monitoring
• Domain Control System (DNS)
  • What Is DNS?
  • DNS Record Types
  • DNS Security Risks
  • DNS Monitoring in SOC
• Transport Layer Technologies and Protocols
  • Role of Transport Layer
  • TCP Handshake Explained
  • Port Numbers and Services
  • Transport Layer Security (TLS)
• Network Security Devices and Cloud Services
  • Network Firewalls
  • IDS/IPS Systems
  • Web Proxies and Gateways
  • Introduction to Cloud Security
  • Cisco Umbrella and SecureX
• Introduced Security Cloud-Based
  • Cloud-Based Network Security
• Network Security System
  • Understanding Network Security Systems
• Cisco NetFlow Overview
  • What Is NetFlow?
• Data Loss Prevention

Module 2: TCP/IP and Cryptography Concepts

• Understanding the TCP/IP Protocol Suite
  • Overview of the TCP/IP Model
  • Application Layer Protocols
  • Transport Layer Protocols: TCP vs UDP
  • Internet Layer and IP Protocols
  • Network Access Layer
  • TCP/IP Packet Encapsulation
  • TCP/IP in Security Monitoring
  • Common Attacks at Each Layer
  • TCP/IP Port Mapping and Filtering
• Understanding the Network Infrastructure
  • What Is Network Infrastructure?
  • Topologies and Design Models
  • 3-Tier Cisco Design
  • Physical vs Logical Segmentation
  • Cabling and Media Types
  • Network Infrastructure Vulnerabilities
  • Role of Infrastructure in Incident Response
• Understanding Basic Cryptography Concepts
  • What Is Cryptography?
  • Symmetric vs Asymmetric Encryption
  • Hashing Algorithms
  • Digital Signatures and Certificates
  • Cryptographic Key Lifecycle
  • VPNs and Tunnelling Protocols
  • Cryptography in Wireless Networks
  • Attacks on Cryptographic Systems

Module 3: Network Applications and Endpoint Security

• Describing Information Security Concepts
  • CIA Triad in Cybersecurity
  • Risk, Threats, and Vulnerabilities
  • Security Controls and Their Types
  • Principle of Least Privilege
• Understanding Network Applications
  • What Are Network Applications?
  • Email Protocols and Security
  • Web-Based Applications (HTTP/S)
  • DNS and Web Browsing
  • Remote Access Applications
• Understanding Common Network Application Attacks
  • Introduction to Application-Layer Attacks
  • Cross-Site Scripting (XSS)
  • SQL Injection (SQLi)
  • DNS Spoofing and Cache Poisoning
  • Application DDoS Attacks
  • Insider Threats in Applications
• Understanding Windows Operating System Basics
  • Windows OS Architecture Overview
  • Windows Registry and Services
  • Task Manager and Resource Monitoring
  • Windows Logs for Security Monitoring
  • Patch Management and Updates
• Understanding Common Endpoint Attacks
  • Introduction to Endpoint Threats
  • Keyloggers and Spyware
  • Ransomware Attacks
  • Credential Dumping
  • Privilege Escalation Techniques
  • Persistence Mechanisms
  • Fileless Malware and LOLBins
  • Endpoint Attack Chain Example
• Understanding Linux Operating System Basics
  • Linux Structure and Distributions
  • Linux File System Hierarchy
  • Key Linux Commands
  • Linux User and Permission System
  • Linux Logs and Auditing
  • Scheduled Jobs and Cron
  • Cron Job Format Task
  • Package Management and Updates
• Understanding Network Security Technologies
  • Antivirus and Anti-Malware Tools
  • Host-Based Intrusion Prevention Systems (HIPS)
  • Endpoint Detection and Response (EDR)
• Understanding Endpoint Security Technologies
  • Application Whitelisting and Sandboxing
  • Host Firewall and Device Control
  • Integrating Endpoint Tools with SOC

Module 4: Security Monitoring and Analysis

• Describing Security Data Collection
  • Importance of Security Data Collection
  • Types of Security Data
  • Role of Log Sources
  • Normal vs Suspicious Log Behaviour
  • SIEM Systems in Data Aggregation
  • Legal and Compliance Considerations
• Packet-Level Data
  • What Is Packet-Level Data?
  • Packet Capture Tools
  • Packet Structure Overview
  • Benefits of Packet Capture
  • Packet Capture Limitations
• Collection method of Packet
  • Network Taps and SPAN Ports
  • Host-Based Packet Capture
  • Inline vs Passive Capture
  • Packet Storage Strategies
  • Filtering Captures with BPF
• Classification of Packet-Level Data
  • Deep Packet Inspection (DPI)
  • Protocol-Based Classification
  • Behavioural Classification
  • Statistical Classification Models
  • Encrypted Traffic Identification
  • Packet Classification for SOC Triage
• Describing Security Event Analysis
  • What Is Security Event Analysis?
  • Correlation Rules and Logic
  • Indicators of Compromise (IoCs)
  • Event Triage and Escalation
  • SOC Analyst Roles in Event Analysis
• Four-Diamond Model Nodes
  • Introduction to the Diamond Model
  • Adversary Node
  • Infrastructure Node
  • Capability Node
  • Victim Node
  • Diamond Model in SOC Practice

Module 5: SOC Overview

• Defining the Security Operations Centre
  • What Is a Security Operations Center (SOC)?
  • Objectives of a SOC
  • SOC Types and Deployment Models
  • SOC vs NOC (Network Operations Center)
• Understanding NSM Tools and Data
  • What Is Network Security Monitoring (NSM) ?
  • Key NSM Tools Overview
  • Suricata in IDS/IPS Mode
  • Zeek for Protocol and Behavioural Analysis
  • NetFlow and Metadata Use
  • Security Onion as NSM Stack
  • Full Packet Capture (FPC) Tools
  • Normalisation and Parsing in NSM
  • Correlation Across NSM Sources
• Understanding Incident Analysis in a Threat-Centric SOC
  • Threat-Centric vs Compliance-Centric SOCs
  • Incident Lifecycle: From Detection to Resolution
  • Use of Playbooks in Incident Analysis
  • Use of Playbooks in Incident Analysis - Step-by-Step Workflow
  • Threat Intelligence in Investigation
  • Identifying Lateral Movement
  • SOC Metrics for Incident Analysis
• Identifying Resources for Hunting Cyber Threats
  • What Is Threat Hunting?
  • Key Threat Hunting Techniques
  • Tools for Threat Hunting
  • Using MITRE ATT&CK in Hunting
  • Developing Hunting Hypotheses

Module 6: Security Incident Investigations

• Understanding Event Correlation and Normalisation
  • What Is Event Correlation?
  • Use Cases for Event Correlation
  • Event Normalisation in SIEMs
  • Tools Supporting Correlation
  • Challenges in Event Correlation
  • Correlation in Action: Credential Misuse
• Identifying Common Attack Vectors
  • What Are Attack Vectors?
  • Phishing and Social Engineering
  • Drive-By Downloads and Malicious Ads
  • Credential Stuffing and Brute Force
  • Supply Chain Attacks
  • Lateral Movement and Privilege Escalation
• Detecting Malicious Activity 
  • IOC vs IOA
  • Signature-Based Detection
  • Behavioural and Anomaly-Based Detection
  • Malware Sandboxing
  • DNS Monitoring and Beaconing
  • Use of Deception Technologies
• Analysing Malware Network Behaviour
  • Common Malware Communications
  • Identifying Data Exfiltration
  • Malware Tactics, Techniques and Procedures (TTPs)
  • Encryption and Obfuscation

Module 7: SOC Operations

• Describing the SOC Playbook
  • What Is a SOC Playbook?
  • Components of a Good Playbook
  • Common Playbook Examples
  • Manual vs Automated Playbooks
• Understanding the SOC Metrics
  • Why SOC Metrics Matter
  • Mean Time to Detect (MTTD)
  • Mean Time to Respond (MTTR)
  • Alert Fatigue and Analyst Load
  • False Positives and True Positives
  • What Is an Incident Response Plan (IRP)?
• Describing the Incident Response Plan
  • Post-Incident Activity – Learning and Strengthening
• Describing the Computer Security Incident Response Team
  • What Is a CSIRT?
  • Types of CSIRT
  • CSIRT Roles and Responsibilities
  • Building a CSIRT Capability
  • CSIRT vs SOC
• VERIS Framework
  • Introduction to the VERIS Framework
  • VERIS Components
  • Using VERIS in Reporting
  • Benefits of VERIS in SOC Operations

Who Should Attend this Cisco CyberOps Associate Training?

The Cisco CyberOps Associate Training is essential for individuals seeking to enhance their expertise in identifying and responding to security incidents using Cisco technologies. Here are the professionals who can benefit from attending this training:

• Security Analysts
• Aspiring Cybersecurity Analysts
• IT Support Specialists
• System Engineers
• IT Security Managers
• Security Operations Centre Personnel
• Network Engineers

Prerequisites of the Cisco CyberOps Associate Training

There are no formal prerequisites for this Cisco CyberOps Associate Training. However, familiarity with basic networking concepts and general IT principles can be beneficial for the delegates.

Cisco CyberOps Associate Training Overview

Cisco CyberOps Associate Training in Beijing is designed to build essential cybersecurity skills for monitoring, detecting, analysing, and responding to security threats. This course introduces delegates to network concepts, TCP/IP, cryptography, endpoint security, security monitoring, incident investigation, and SOC operations.

This training develops practical knowledge of threat analysis, security event monitoring, packet-level data, incident response, and SOC workflows. It helps delegates understand how cybersecurity teams detect suspicious activity, investigate incidents, and support real-world cyber defence operations.

This 3-Day course by The Knowledge Academy provides practical learning through guided concepts, hands-on examples, and real-world cybersecurity scenarios. Upon completion, delegates will be able to understand SOC processes, analyse security events, identify attack vectors, and support effective incident response activities.

Cisco CyberOps Associate Training Course Objectives

• To identify common threats, vulnerabilities, attack vectors, and security risks
• To explain TCP/IP, cryptography, endpoint security, and network security technologies
• To use security monitoring techniques to detect and analyse suspicious activity
• To apply incident response processes to investigate and manage cybersecurity incidents
• To understand SOC workflows, playbooks, metrics, event correlation, and threat hunting
• To gain practical knowledge of tools and techniques used in real-world SOC environments

Upon completion of this course, delegates will have the skills to support security monitoring, threat analysis, and incident response activities within a Security Operations Centre.

What’s Included in this Cisco CyberOps Associate Training?

• World-Class Training Sessions from Experienced Instructors
• Cisco CyberOps Associate Certificate
• Digital Delegate Pack