Course Outline
Introduction & Course Orientation for Government
- Overview of course objectives, expected outcomes, and laboratory environment setup for government agencies
- Examination of high-level EDR architecture and OpenEDR components tailored for government use
- Review of the MITRE ATT&CK framework and foundational principles of threat hunting in a public sector context
OpenEDR Deployment & Telemetry Collection for Government
- Installation and configuration of OpenEDR agents on Windows endpoints within government networks
- Overview of server components, data ingestion pipelines, and storage considerations for government deployments
- Configuration of telemetry sources, event normalization, and enrichment processes to meet public sector requirements
Understanding Endpoint Telemetry & Event Modeling for Government
- Identification of key endpoint event types, fields, and their mapping to ATT&CK techniques in government environments
- Techniques for event filtering, correlation strategies, and noise reduction tailored for public sector use
- Methods for creating reliable detection signals from low-fidelity telemetry in government settings
Mapping Detections to MITRE ATT&CK for Government
- Translation of telemetry into ATT&CK technique coverage and identification of detection gaps within government systems
- Utilization of the ATT&CK Navigator and documentation of mapping decisions in a public sector context
- Prioritization of techniques for hunting based on risk assessments and telemetry availability in government agencies
Threat Hunting Methodologies for Government
- Comparison of hypothesis-driven hunting versus indicator-led investigations within government operations
- Development of hunt playbooks and iterative discovery workflows for public sector environments
- Hands-on hunting labs focusing on identifying lateral movement, persistence, and privilege escalation patterns in government networks
Detection Engineering & Tuning for Government
- Design of detection rules using event correlation and behavioral baselines specific to government operations
- Testing and tuning of rules to reduce false positives and measure effectiveness in a public sector setting
- Creation of signatures and analytic content for reuse across government environments
Incident Response & Root Cause Analysis with OpenEDR for Government
- Use of OpenEDR to triage alerts, investigate incidents, and create attack timelines in government systems
- Forensic artifact collection, evidence preservation, and chain-of-custody considerations specific to public sector investigations
- Integration of findings into incident response playbooks and remediation workflows for government agencies
Automation, Orchestration & Integration for Government
- Automation of routine hunts and alert enrichment using scripts and connectors tailored for government operations
- Integration of OpenEDR with SIEM, SOAR, and threat intelligence platforms within the public sector
- Scaling telemetry, retention, and operational considerations for enterprise deployments in government agencies
Advanced Use Cases & Red Team Collaboration for Government
- Simulation of adversary behavior for validation through purple-team exercises and ATT&CK-based emulation in government settings
- Case studies: real-world hunts and post-incident analyses from public sector incidents
- Design of continuous improvement cycles for detection coverage within government agencies
Capstone Lab & Presentations for Government
- Guided capstone project: full hunt from hypothesis through containment and root cause analysis using lab scenarios relevant to government operations
- Participant presentations of findings and recommended mitigations tailored for public sector use
- Course wrap-up, distribution of materials, and recommendations for next steps in government cybersecurity initiatives
Requirements
- A foundational understanding of endpoint security principles
- Practical experience in log analysis and basic administration of Linux and Windows systems
- Knowledge of common attack methodologies and incident response frameworks
Audience
- Security Operations Center (SOC) analysts for government
- Threat hunters and incident responders within the public sector
- Security engineers tasked with detection engineering and telemetry management
Testimonials (4)
The trainer was very knowledgable and took time to give a very good insight into cyber security issues. A lot of these examples could be used or modified for our learners and create some very engaging lesson activities.
Jenna - Merthyr College
Course - Fundamentals of Corporate Cyber Warfare
Pentester skills what demonstrate teacher
Oleksii Adamovych - EY GLOBAL SERVICES (POLAND) SP Z O O
Course - Ethical Hacker
The instructor has a very wide range of knowledge and is committed to what he does. He is able to interest the listener with his course. The scope of the training fully met my expectations.
Karolina Pfajfer - EY GLOBAL SERVICES (POLAND) SP Z O O
Course - MasterClass Certified Ethical Hacker Program
All is excellent
