Skip to content
academia.sh
tr
Log in

Course Advanced

Security Operations and Incident Response

Published Updated

By the end of this course

Start course

01

Detection Infrastructure

Builds the pipeline for the time between detection and containment: shift capacity and the case that fails to merge at the handover point, normalizing three log formats into a single schema and the field that cannot be mapped, the event a correlation rule merges and the one it misses, the question network flow data can answer without payload content, the threshold point where false positives and missed detections cannot be reduced at the same time, the number of techniques two rule versions cover, the item eliminated per hypothesis, the lifespan difference between indicator-based and behavior-based feeds, and automating repeated response.

  1. 01 Security Operations Center 273 alerts falling on a fictional line are measured against a three-person shift: the day's work is 1,506 minutes, capacity is 1,440 minutes; the plan that splits twenty-four hours evenly leaves 64 alerts never reviewed and pushes the median wait to 222 minutes, while the plan that leans on density leaves eight hours uncovered and brings that down to 13 alerts and 83 minutes. 19 of 26 cases cross the handover point; with an empty handover note, 19 cases never merge and the median case decision is 987 minutes, dropping to zero unmerged cases at a six-item note with the median falling to 273 minutes, while at twelve items the handover eats 72 minutes and pushes never-reviewed alerts to 26.
  2. 02 Log Aggregation and Normalization Three separately formatted fictional logs are normalized into a single schema, and the fields that do not map are counted: 15 of 24 source fields fit an eight-field schema, 9 remain unmapped; four schema fields are empty in the network-flow log, and none of the 404 records has an actor. The sources write the same event 1, 5, and 8 minutes later. Two lookup tables fill in the actor field: 115 of 139 control-plane records convert to an account, 24 do not convert; in a five-minute window, 190 of 404 flow records get an actor assigned, 212 stay empty, and at sixty minutes the assignment rises to 208 while ambiguous records jump from 2 to 39. Of 26 events that leave a trace in two sources, 21 get collected; in a one-minute window, none do.
  3. 03 Security Information and Event Management A three-condition correlation rule runs against a fictional 3,083-record event stream: the rule produces 10 alerts, and these alerts merge 161 raw events, 16.1 events per alert. Three of five fictional campaigns are caught; one stays below the threshold, one never appears because its third step exists only in network flow. The funnel narrows from 3,083 records to 12 candidates, from 12 candidates to 10 alerts, from 10 alerts to 3 decisions, and takes 43 minutes from the first record landing. In the threshold, window and lag sweep, no setting brings in all five of the five campaigns; the best row is 4/5 and 1 false positive.
  4. 04 Network Flow Data Four metadata-only metrics run against 2,979 fictional flow records: regular interval flags 7 pairs and 6 of them are meter transfer, exit ratio flags 23 and 22 of them are nightly backup, new destination flags 7 and 6 of them are a new work item, long session flags 6 and 5 of them are an admin session. All four of the fictional items get flagged, but 39 of the 43 total pairs are legitimate. Of ten questions asked against the same record set, 6 are answered from metadata alone; what was sent, which account did it, whether the request was accepted, and which process started it stay unanswered. If everything flagged were cut, 630 flows and 8.8 GB of legitimate work would stop.
  5. 05 False Positives and False Negatives 20 of 900 candidate items are fictional, and the score distributions from four attributes overlap in the 37–88 band: that band holds 157 legit and 17 fictional items, and no threshold can separate the two at once. At threshold 40, false positive is 124 and missed is 1; at threshold 80, false positive is 1 and missed is 11; even at the threshold 70 that minimizes total error, 4 false positives and 4 missed remain. A daily budget of 144 analyst-minutes nails the threshold to 72: 16 alerts, 7 missed items, and 42 items reached. A fifth attribute narrows the band to 49–75 and to 15 legit and 7 items, pulling the budget threshold down to 66, but a zero-zero threshold is still nowhere to be found.
  6. 06 Detection Engineering Two rule versions are compared on a fictional classification matrix with eight tactic columns and 26 technique rows: version 1's 6 rules cover 11 techniques but only 8 are firable, 15 techniques are never covered; version 2's 11 rules cover 24 techniques, 19 firable, never-covered drops to 2. Over 51 fictional samples, version 1 catches 10, version 2 catches 30; once the reason for a miss is separated out, no-rule drops from 32 to 3 while no-source rises from 4 to 11. An extra 220 minutes of writing work comes to 11 minutes per sample, daily false positive drops from 30 to 27, but review load rises from 360 minutes to 513 minutes.
  7. 07 Threat Hunting Six hypotheses are run against a fictional telemetry set of 12,910 records, and the items eliminated per hypothesis are counted: h1 eliminates 12,906 records in three steps and leaves 4 items, h4 leaves 6 items in two steps, h3 leaves 283 items and becomes impossible to review; h2, h5, and h6 find no fictional item at all but write 370 items to the baseline. A total of 1,691 minutes of search finds two fictional items, 846 minutes per item; writing a rule cost 11 minutes per sample. Two of the six hypotheses convert into a rule because they stay under the daily ten-alert limit, and four exceed the limit or return empty.
  8. 08 Threat Intelligence A fictional feed of 900 indicators and 12 behavior definitions is compared on the lifespan axis over a 90-day window: the median life of an address indicator is 5 days, a file hash 2 days, a name 15 days; a behavior definition's median life is 358 days. Of the 900 indicators added by the ninetieth day, only 72 are valid, 828 are dead. Of 60 fictional contacts, 5 match the indicator list, 28 have an indicator not yet on the list that day, and 27 have an indicator whose life has expired. Raising retention from 3 days to 90 days moves caught contacts from 2 to 5 while raising dead matches from 2 to 190 and review time from 36 minutes to 1,755 minutes. Behavior definitions catch 27 contacts and produce no dead matches; catch per item is 5.6 per mille against 2,250 per mille.
  9. 09 Response Automation Eight recurring response procedures produce 158 items and 1,215 minutes of manual work per day; full automation cuts that to 281 minutes but brings 2.65 wrong automatic actions per day and a 457-minute cost, for a net gain of 477 minutes. Three procedures give a net negative under full automation: account lockout -4, address blocking -72, endpoint isolation -72 minutes. Human-approved mode gives a net gain of 715 minutes with zero wrong actions; selecting the best mode per procedure raises the daily net to 870 minutes, and the 3,120-minute write-up work is repaid in 4 days. When the cut legit work item's minute value is taken as 90, full automation drops to -60 minutes at a 1x wrong rate.

02

Incident Response

Measuring the time between detection and containment in items: how many minutes preparation items cut from the decision chain, how many assets the incident's verification and scope radius miss, the item gap between early and late containment in the same incident, removing persistence in terms of foothold points, supervised recovery along the axis of reinfection risk, lessons learned along the axis of evidence and scope, and notification obligations measured as duration and stakeholder count.

  1. 01 Preparation Counting preparation in items: how twelve preparation items cut the six-step chain from alert to decision from 470 minutes to 182 minutes, pulling the containment moment from 656 to 368 and the items reached from 13 to 9, how the asset inventory's absence alone adds 49 minutes, how the communication tree earns 5.00 minutes per person-hour while forensic collection readiness stays at 0.11, and how pre-approved authority earns 103 minutes a year while cutting 233 legitimate work items.
  2. 02 Identification Measuring scope determination in candidates and minutes: how the seven scope criteria bring between 1 and 19 candidates in a thirty-asset inventory, how the scope step ranges between 3 and 73 minutes, how the log indicator's four candidates in 10 minutes leave the same number of items open as radius two's seventeen candidates in 68 minutes, how the widest criterion cuts legitimate work unnecessarily on thirteen assets, and how two reached collectors cannot be verified by any criterion because they transmit only network flow data.
  3. 03 Containment Calculating the item gap between early and late containment in the same incident: running eight short-term and four long-term actions across seven regimes; early containment stopping at minute 393 with 10 items reached and cutting 1,161 legitimate work items, versus long-term-only containment stopping at minute 765 with 15 items reached and cutting none; the cost of five extra items being 232 legitimate work items per extra item; the same cut rising to 11,687 items with no long-term action; and, in the yearly balance, the early policy preventing 30 extra items against 9,171 legitimate work items.
  4. 04 Eradication Measuring the removal of persistence in terms of footholds: finding 17 of 22 points across nine affected assets in 506 minutes with five discovery methods; three of four configuration hooks going unfound by any method because they were lost on assets taken off the network during containment; across six eradication regimes, the missed-point count dropping from 10 to 0 as total time climbs from 353 minutes to 1,361 minutes; and five missed points producing 8 reinfections in 60 days, with the first on day five.
  5. 05 Recovery Measuring recovery along the axis of reinfection risk: three of seven recovery points being clean, with the newest one nine and a half days back; returning to the clean backup costing 94,715 items of data and 44 manually rebuilt items; rebuilding from scratch giving the same cleanliness for 190 more minutes at a cost of 2,493 lost items; returning to a dirty backup rerunning eradication from scratch and raising total time to 1,347 minutes; and the four-stage supervised restoration bringing the expected points reaching production down from 5.00 to 0.10.
  6. 06 Lessons Learned Measuring the review along the axis of evidence and scope: eleven of sixteen questions being answered with nine record sources, five questions staying unanswered for three distinct reasons, five of twelve improvement items resting directly on a missing record, record-only improvements bringing the answered-question count to 16 for 136 person-hours while shaving 22 minutes off the chain, and preparation and process improvements gaining 55 minutes for 103 person-hours while opening no questions at all.
  7. 07 Communication and Notification Obligations Measuring notification as time and stakeholder count: five of twelve stakeholders being external, the 4,320-minute window of the obligation type that requires notification within a fixed time, the scope estimate dropping from 48,000 to 6,200 without ever settling, early notification over-notifying 14,800 subscribers and producing 46 corrections against staying at 29,967 uninformed subscriber-hours, and late notification exceeding the window by 64,540 minutes across five external stakeholders while producing 1,793,247 subscriber-hours.

03

Forensic Examination

Measuring the evidence item: evidence integrity and how many items the chain of custody breaks at, the verifiability of write-blocked copying and the items a partial copy misses, the items lost when order of volatility and collection order go wrong, merging three sources' timelines and the order that clock skew disrupts, the evidence value of a trace extracted from system structures, and presenting technical findings as a claim-to-evidence mapping in the legal context.

  1. 01 Forensic Examination Principles Measuring evidence integrity and chain of custody in items: 28 evidence items, 78 transfers, and five record fields per transfer; 10 of 390 fields left blank puts 9 items in question, and hash mismatches put 3 more in question, leaving 12 of 28 items indefensible. If a single point in the field chain loses its record entirely, 13 items open up at once; the way a 2.6 percent record gap turns into a 43 percent item loss comes from the chain's structure.
  2. 02 Disk Imaging Measuring the verifiability of write-blocked copying: on a fictional 4,096-slice source, a selective directory copy takes 4 of 15 evidence items, a logical copy takes 8, a partition block takes 13, and a full block copy takes all 15. Because the source hash can be recomputed in an offline copy, 15 of 15 items are verified; in a copy taken from a running system, 303 of 4,096 slices change, all three hashes come out different, and the number of verified items drops to 9.
  3. 03 Memory Dump Analysis Establishing an order of volatility and counting the items a collection order costs: 28 evidence items are arranged into 10 volatility classes; with a single collector, the correct order loses 7 items, host-by-host collection loses 12, and largest-item-first collection loses 18. A three-person team following the correct order has 0 losses, a six-person team following the wrong order has 13; the wrong order is also the fastest collection to finish, because a lost item spends no time. The memory dump is relevant to 8 of 12 questions and answers 4 of them on its own.
  4. 04 Timeline Creation Merging the events of three sources onto a single timeline, and how clock skew breaks the ordering: raw merging of 54 events forming 1,431 pairs produces 35 inverted pairs, 33 of the 54 events land in the wrong position, and the largest skew is 243 seconds. Once skew is estimated and corrected using nineteen anchor events, inverted pairs drop to 1, wrong position drops to 2, and the correction changes the position of 34 events. All 35 of the 35 inverted pairs come from two different sources; skew never breaks a source's own internal order.
  5. 05 Structure and Record Examination Measuring the evidentiary value of traces left by system structures: of 12 structures, 7 are in the direct class and 5 are in the inference class, and their bases range from 4 to 187 in a 268-machine fictional fleet. Of seven claims, 2 are distinctive, 4 are weak, and 1 is noise; the claim resting on a single structure is also true on 187 clean machines. A claim with three bases turns out weaker than a claim with two bases when all three bases are in the inference class, and the independence assumption makes the calculation a lower bound.
  6. 06 Reporting Measuring technical findings as a claim-to-evidence mapping: in a fictional 20-claim report draft built on 22 items collected by a three-person shift, 10 claims come out directly supported, 9 are inference, and 1 is unsupported. Seven of the 9 claims counted as inference drop there because of chain-of-custody gaps, and 2 are already inference. Perfect collection yields 11 direct claims, while host-by-host collection with a one-person team drops that to 7 and raises unsupported claims to 3.

Final exam

Security Operations and Incident Response — Final Exam

In preparation

This course's question bank is not complete yet. The exam opens here automatically once enough questions are added.

Start typing to search.

↑↓ ↵ Esc navigate · open · close