Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Introduction & Course Orientation
- Course goals, anticipated outcomes, and lab environment preparation
- Overview of EDR architecture and OpenEDR core components
- Review of the MITRE ATT&CK framework and foundational threat-hunting concepts
OpenEDR Deployment & Telemetry Collection
- Installation and configuration of OpenEDR agents on Windows endpoints
- Server components, data ingestion pipelines, and storage requirements
- Setup of telemetry sources, event normalization, and data enrichment
Understanding Endpoint Telemetry & Event Modeling
- Core endpoint event types, data fields, and their alignment with ATT&CK techniques
- Strategies for event filtering, correlation, and noise mitigation
- Deriving reliable detection signals from low-fidelity telemetry data
Mapping Detections to MITRE ATT&CK
- Converting telemetry into ATT&CK technique coverage and identifying detection gaps
- Leveraging ATT&CK Navigator and documenting mapping rationale
- Prioritizing hunting targets based on risk levels and telemetry availability
Threat Hunting Methodologies
- Contrasting hypothesis-driven hunting with indicator-based investigations
- Developing hunt playbooks and iterative discovery processes
- Practical hunting labs: detecting lateral movement, persistence, and privilege escalation
Detection Engineering & Tuning
- Formulating detection rules through event correlation and behavioral baselines
- Testing rules, refining to minimize false positives, and assessing efficacy
- Developing reusable signatures and analytic content for the environment
Incident Response & Root Cause Analysis with OpenEDR
- Utilizing OpenEDR for alert triage, incident investigation, and attack timeline reconstruction
- Collecting forensic artifacts, preserving evidence, and maintaining chain-of-custody
- Embedding findings into IR playbooks and remediation processes
Automation, Orchestration & Integration
- Automating routine hunts and alert enrichment via scripts and connectors
- Connecting OpenEDR with SIEM, SOAR, and threat intelligence platforms
- Scalability, retention strategies, and operational factors for enterprise environments
Advanced Use Cases & Red Team Collaboration
- Simulating adversary actions for validation through purple-team exercises and ATT&CK-based emulation
- Case studies: real-world hunting scenarios and post-incident reviews
- Establishing continuous improvement cycles for detection coverage
Capstone Lab & Presentations
- Supervised capstone: end-to-end hunting from hypothesis to containment and root cause analysis using lab scenarios
- Participant presentations of insights and proposed mitigations
- Course conclusion, resource distribution, and suggested next steps
Requirements
- A solid grasp of endpoint security principles
- Practical experience in log analysis and fundamental Linux/Windows administration
- Knowledge of prevalent attack vectors and incident response methodologies
Intended Audience
- Security Operations Center (SOC) analysts
- Threat hunters and incident response specialists
- Security engineers focused on detection engineering and telemetry management
Testimonials (2)
Clarity and pace of explanations
Federica Galeazzi - Aethra Telecomunications SRL
Course - AI-Powered Cybersecurity: Advanced Threat Detection & Response
It did give me the insight what I needed :) I am starting teaching on a BTEC Level 3 qualification and wanted to widen my knowledge in this area.
