4AS 2: SOC avancéAdministration Audit et Analyse de Sécurité (STI)

• Understanding the relevance of setting up a SOC environment, how it works and how it can relate to other areas of information technology

1. Reminder: Introduction to SOC

• Definition

• Issues

• Organization

• Architecture

• Environment

  2. Model Threat

• The different phases of an attack (Kill Chain)

• MITRE ATT&CK

• TTPs

  3. The detection strategy

• Definition

• Detection equipment/tools, their characteristics and associated problems

• Collection of logs

• Detection System

• Network Detection

• The design of a detection strategy

  4. Analysis and qualification of a security incident

• Qualification (false positive / true positive)

• Analysis (system, networks), investigation, threat level identification

• Triggering incident response

  5. Process of continuous improvement

• Responding to changing threats

• Evolving tools

• Evaluate the operation of SOC (Introduction to Red Team, Blue Team, Purple Team)

  6. CTI (Cyber Threat Intelligence)

• Threat information

• Information exchange platforms (TIPs)

• Sources of intelligence

TD/TP/Group Project: 1. The building

• Installation and configuration of a brick of security solutions (SIEM, Log Collection, NIDS, HIDS, XDR)

• Improved detection strategy (creation of new detection rules)

  2. Run

• Analysis and investigation following an attack on the monitored infrastructure

• Preparation of an analysis report, presentation of results and feedback (continuous improvement)

Report