This phase builds the foundation of working in a Security Operations Center (SOC). You’ll start with the structure of SOC environments, their tiers, and the responsibilities of analysts at different levels. The course then takes you through the fundamentals of event classification, incident response frameworks (NIST, MITRE ATT&CK, Cyber Kill Chain), and threat analysis methodology. You’ll learn in detail how to detect intrusions through log analysis, packet captures, NetFlow, and endpoint telemetry. Focus is placed on using tools like Cisco Secure Endpoint, Firepower, and SIEM platforms for continuous monitoring. A major part of this phase is devoted to correlating security events from multiple sources like DNS, email, web traffic, and encrypted communications. You will also learn the art of filtering false positives and escalating true positives effectively. Cloud monitoring concepts are introduced to help detect misconfigurations and attacks in AWS and Azure. Finally, this phase emphasizes building a strong analytical mindset, enabling you to investigate raw security data, recognize anomalies, and initiate the first steps of incident response.

This phase is all about becoming hands-on with incident response and digital forensics. You’ll begin with the incident lifecycle: detection, analysis, containment, eradication, and recovery. Emphasis is placed on evidence collection and handling; ensuring proper chain of custody, disk imaging, and memory acquisition. You’ll get exposure to live forensics for volatile memory and learn how to capture artifacts such as processes, registry keys, and network connections. Malware analysis basics are included, covering static and dynamic analysis to identify indicators of compromise (IOCs) and persistence mechanisms. This module also trains you to perform timeline analysis, trace attacker activity, and prepare detailed forensic reports that can stand legal scrutiny. Endpoint forensics is combined with network-level analysis, allowing you to investigate lateral movement, credential dumping, and privilege escalation. By the end of this phase, you will be comfortable conducting in-depth investigations, remediating compromised assets, and documenting findings that support compliance and legal requirements.

This advanced phase transforms you from a reactive responder to a proactive threat hunter. You’ll start with the foundations of threat hunting: hypothesis-driven investigations, adversary emulation, and leveraging frameworks like MITRE ATT&CK for mapping attacker behavior. The course focuses on gathering and operationalizing threat intelligence feeds, including open-source and premium sources, to guide your hunts. You’ll explore behavioral analytics, detecting subtle signs of stealthy attackers like beaconing traffic, persistence tools, and abnormal user behavior. Cloud-native hunting is a major focus here, covering visibility gaps in AWS, Azure, and hybrid infrastructures. Hands-on labs will take you through designing hunt playbooks, executing hunts across logs, endpoints, and SIEM platforms, and documenting hunt outcomes for executive teams. You’ll also learn advanced hunting techniques such as hunting for zero-days, insider threats, and fileless malware that evade traditional defenses. The phase concludes with real-world simulations where you execute end-to-end hunting campaigns, refine defenses, and proactively strengthen enterprise security posture.

Investigate complex alerts and perform advanced incident analysis.

Advises organizations on improving security posture.

Leads SOC teams, manages incident handling, and develops strategies for organizational defense.

Collects and analyzes threat data to predict and prevent attacks.

Monitor, detect, and respond to real-world security threats.

Contain, eradicate, and recover systems during cyberattacks.

Proactively uncover hidden adversaries inside networks.

Analyze malware and conduct digital investigations post-incident.

Design and optimize SOC workflows, tools, and defenses.

CBRCOR (350-201) → Cisco Certified Cybersecurity Core Specialist CBRCN (300-215) → Cisco Certified Cybersecurity Forensic Analysis and Incident Response Specialist CBRTHD (300-220) → Cisco Certified Cybersecurity Threat Hunting and Defending Specialist CCNP Cybersecurity → Cisco Certified Cybersecurity Professional