Conducting Threat Hunting and Defending using Cisco Technologies for CyberOps (CBRTHD)

This training will help you:

• Learn how to perform a proactive security search through networks, endpoints, and datasets to hunt for malicious, suspicious, and risky activities that may have evaded detection by existing tools
• Gain leading-edge career skills focused on cybersecurity
• Prepare for the 300-220 CBRTHD v1.0 exam
• Earn 40 CE credits toward recertification

1. Threat Hunting Theory
2. Threat Hunting Concepts, Frameworks, and Threat Models
3. Threat Hunting Process Fundamentals
4. Threat Hunting Methodologies and Procedures
5. Network-Based Threat Hunting
6. Endpoint-Based Threat Hunting
7. Endpoint-Based Threat Detection Development
8. Threat Hunting with Cisco Tools
9. Threat Hunting Investigation Summary: A Practical Approach
10. Reporting the Aftermath of a Threat Hunt Investigation

1. Categorize Threats with MITRE ATTACK Tactics and Techniques
2. Compare Techniques Used by Different APTs with MITRE ATTACK Navigator
3. Model Threats Using MITRE ATTACK and D3FEND
4. Prioritize Threat Hunting Using the MITRE ATTACK Framework and Cyber Kill Chain
5. Determine the Priority Level of Attacks Using MITRE CAPEC
6. Explore the TaHiTI Methodology
7. Perform Threat Analysis Searches Using OSINT
8. Attribute Threats to Adversary Groups and Software with MITRE ATTACK
9. Emulate Adversaries with MITRE Caldera
10. Find Evidence of Compromise Using Native Windows Tools
11. Hunt for Suspicious Activities Using Open-Source Tools and SIEM
12. Capturing of Network Traffic
13. Extraction of IOC from Network Packets
14. Usage of ELK Stack for Hunting Large Volumes of Network Data
15. Analyzing Windows Event Logs and Mapping Them with MITRE Matrix
16. Endpoint Data Acquisition
17. Inspect Endpoints with PowerShell
18. Perform Memory Forensics with Velociraptor
19. Detect Malicious Processes on Endpoints
20. Identify Suspicious Files Using Threat Analysis
21. Conduct Threat Hunting Using Cisco Secure Firewall, Cisco Secure Network Analytics, and Splunk
22. Conduct Threat Hunt Using Cisco XDR Control Center and Investigate
23. Initiate, Conduct, and Conclude a Threat Hunt

The knowledge and skills you are expected to have before attending this training are:

• General knowledge of networks
• Cisco CCNP Security certification

These skills can be found in the following Cisco Learning Offerings:

• Implementing and Administering Cisco Solutions (CCNA)
• Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)
• Performing CyberOps Using Cisco Security Technologies (CBRCOR)
• Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CyberOps (CBRFIR)