Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
Introduction & Course Orientation
- Overview of course objectives, expected outcomes, and setup of the lab environment for government participants.
- Examination of high-level EDR architecture and OpenEDR components relevant to public sector operations.
- Review of the MITRE ATT&CK framework and foundational principles of threat hunting for government agencies.
OpenEDR Deployment & Telemetry Collection
- Instructions for installing and configuring OpenEDR agents on Windows endpoints within a government setting.
- Overview of server components, data ingestion pipelines, and storage considerations tailored for government use cases.
- Guidance on configuring telemetry sources, event normalization, and enrichment processes to support government operations.
Understanding Endpoint Telemetry & Event Modeling
- Identification of key endpoint event types, fields, and their mapping to ATT&CK techniques for effective threat detection in government environments.
- Techniques for event filtering, correlation strategies, and noise reduction to enhance situational awareness for government agencies.
- Methods for creating reliable detection signals from low-fidelity telemetry data within the context of government operations.
Mapping Detections to MITRE ATT&CK
- Procedures for translating telemetry into ATT&CK technique coverage and identifying detection gaps specific to government needs.
- Utilization of the ATT&CK Navigator tool and documentation of mapping decisions to support government threat hunting efforts.
- Strategies for prioritizing techniques for hunting based on risk assessments and telemetry availability in government settings.
Threat Hunting Methodologies
- Comparison of hypothesis-driven hunting and indicator-led investigations, with a focus on government applications.
- Development of hunt playbooks and iterative discovery workflows tailored for government threat hunters.
- Hands-on labs for identifying lateral movement, persistence, and privilege escalation patterns in government networks.
Detection Engineering & Tuning
- Techniques for designing detection rules using event correlation and behavioral baselines, with a focus on government environments.
- Processes for rule testing, tuning to minimize false positives, and measuring the effectiveness of detection rules in government settings.
- Creation of signatures and analytic content for reuse across government systems.
Incident Response & Root Cause Analysis with OpenEDR
- Use of OpenEDR to triage alerts, investigate incidents, and create attack timelines in a government context.
- Procedures for forensic artifact collection, evidence preservation, and chain-of-custody considerations specific to government operations.
- Integration of findings into incident response (IR) playbooks and remediation workflows for government agencies.
Automation, Orchestration & Integration
- Automation of routine hunts and alert enrichment using scripts and connectors, with a focus on government operations.
- Integration of OpenEDR with SIEM, SOAR, and threat intelligence platforms to enhance government security capabilities.
- Considerations for scaling telemetry, retention, and operational practices in enterprise deployments for government agencies.
Advanced Use Cases & Red Team Collaboration
- Simulation of adversary behavior to validate detection capabilities: conducting purple-team exercises and ATT&CK-based emulation in government settings.
- Case studies of real-world hunts and post-incident analyses relevant to government operations.
- Development of continuous improvement cycles for enhancing detection coverage in government environments.
Capstone Lab & Presentations
- Guided capstone project: conducting a full hunt from hypothesis through containment and root cause analysis using lab scenarios designed for government participants.
- Participant presentations of findings and recommended mitigations, with a focus on government-specific challenges and solutions.
- Course wrap-up, distribution of materials, and recommendations for next steps in advancing government threat hunting capabilities.
Requirements
- An understanding of endpoint security fundamentals for government use.
- Experience with log analysis and basic Linux/Windows administration.
- Familiarity with common attack techniques and incident response concepts.
Audience
- Security operations center (SOC) analysts for government agencies.
- Threat hunters and incident responders in the public sector.
- Security engineers responsible for detection engineering and telemetry within government organizations.
21 Hours
Testimonials (4)
The trainer was very knowledgable and took time to give a very good insight into cyber security issues. A lot of these examples could be used or modified for our learners and create some very engaging lesson activities.
Jenna - Merthyr College
Course - Fundamentals of Corporate Cyber Warfare
Pentester skills what demonstrate teacher
Oleksii Adamovych - EY GLOBAL SERVICES (POLAND) SP Z O O
Course - Ethical Hacker
The instructor has a very wide range of knowledge and is committed to what he does. He is able to interest the listener with his course. The scope of the training fully met my expectations.
Karolina Pfajfer - EY GLOBAL SERVICES (POLAND) SP Z O O
Course - MasterClass Certified Ethical Hacker Program
All is excellent
