Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Module 1: Introduction & Program Orientation
- Learning objectives, anticipated competencies, and laboratory environment initialization
- Conceptual overview of EDR architecture and OpenEDR core components
- Review of the MITRE ATT&CK framework and foundational threat-hunting principles
Module 2: OpenEDR Deployment & Telemetry Ingestion
- Installation and configuration of OpenEDR agents on Windows endpoints
- Server-side components, data ingestion pipelines, and storage architecture considerations
- Configuration of telemetry sources, event normalization, and data enrichment processes
Module 3: Endpoint Telemetry Interpretation & Event Modeling
- Analysis of key endpoint event types, fields, and their mapping to ATT&CK techniques
- Event filtering, correlation strategies, and methods for noise reduction
- Deriving reliable detection signals from low-fidelity telemetry data
Module 4: Aligning Detections with MITRE ATT&CK
- Translating telemetry into ATT&CK technique coverage and identifying detection gaps
- Utilizing ATT&CK Navigator and documenting mapping decisions for accountability
- Prioritizing techniques for hunting based on risk posture and telemetry availability
Module 5: Threat Hunting Methodologies
- Hypothesis-driven hunting vs. indicator-led investigations
- Development of hunt playbooks and iterative discovery workflows
- Practical hunting exercises: identifying lateral movement, persistence, and privilege escalation patterns
Module 6: Detection Engineering & Optimization
- Designing detection rules using event correlation and behavioral baselines
- Rule testing, tuning to minimize false positives, and measuring operational effectiveness
- Creating signatures and analytic content for reuse across the enterprise environment for government
Module 7: Incident Response & Root Cause Analysis with OpenEDR
- Utilizing OpenEDR to triage alerts, investigate incidents, and construct attack timelines
- Forensic artifact collection, evidence preservation, and chain-of-custody protocols
- Integrating findings into IR playbooks and remediation workflows for government
Module 8: Automation, Orchestration & System Integration
- Automating routine hunts and alert enrichment using scripts and connectors
- Integrating OpenEDR with SIEM, SOAR, and threat intelligence platforms
- Scaling telemetry, retention, and operational considerations for enterprise deployments
Module 9: Advanced Use Cases & Red Team Collaboration
- Simulating adversary behavior for validation: purple-team exercises and ATT&CK-based emulation
- Case studies: real-world hunts and post-incident analyses
- Designing continuous improvement cycles for detection coverage
Module 10: Capstone Laboratory & Briefings
- Guided capstone: full hunt from hypothesis through containment and root cause analysis using lab scenarios
- Participant briefings of findings and recommended mitigations
- Course conclusion, resource distribution, and recommended next steps
Requirements
- A solid understanding of endpoint security fundamentals
- Experience with log analysis and basic Linux/Windows administration
- Familiarity with common attack techniques and incident response concepts
Target Audience
- Security operations center (SOC) analysts
- Threat hunters and incident responders
- Security engineers responsible for detection engineering and telemetry
Testimonials (2)
Clarity and pace of explanations
Federica Galeazzi - Aethra Telecomunications SRL
Course - AI-Powered Cybersecurity: Advanced Threat Detection & Response
It did give me the insight what I needed :) I am starting teaching on a BTEC Level 3 qualification and wanted to widen my knowledge in this area.
