К содержимому
learnspaceYOUR NEXT CHAPTER
ПРОСТРАНСТВО ОБУЧЕНИЯ
ГлавнаяКаталог курсовМоё обучениеCoursera

Знания без границ

Учитесь у лучших университетов и компаний мира.

Открыть Coursera
Интеграция
Пространство университета
Моё пространствоСтраница курса
↵
ЯЛичный кабинетСтудент
© 2026 LearnSpaceКаждый день — возможность узнать больше.Помощь
Threat Analysis · LearnSpace
Назад в каталог
courseraIT и технологии

Threat Analysis

Курс от Cisco Learning and Certifications
Уровень не указан≈ 26.6 чАнглийский
О курсеНавыкиПрограммаПреподаватели

О курсе

If you are an associate-level cybersecurity analyst who is working in security operation centers, this course will help you understand Incident Analysis in a Threat-Centric SOC. By the end of the course, you will be able to: •Use the classic kill chain model to perform network security incident analysis • Describe the reconnaissance phase of the classic kill chain model • Describe the weaponization phase of the classic kill chain model • Describe the delivery phase of the classic kill chain model • Describe the exploitation phase of the classic kill chain model •Describe the installation phase of the classic kill chain mode l• Describe the command-and-control phase of the classic kill chain model • Describe the actions on objectives phase of the classic kill chain model • Describe how the kill chain model can be applied to detect and prevent ransomware • Describe using the diamond model to perform network security incident analysis • Describe how to apply the diamond model to perform network security incident analysis using a threat intelligence platform, such as ThreatConnect • Describe the MITRE ATTACK framework and its use • Walk-through the classic kill chain model and use various tool capabilities of the Security Onion Linux distribution •Understand the kill chain and the diamond models for incident investigations, and the use of exploit kits by threat actors. To be successful in this course, you should have the following background: 1. Skills and knowledge equivalent to those learned in Implementing and Administering Cisco Solutions (CCNA) v1.0 course 2. Familiarity with Ethernet and TCP/IP networking 3. Working knowledge of the Windows and Linux operating systems 4. Familiarity with basics of networking security concepts.

Навыки, которые вы освоите

Threat DetectionNetwork AnalysisNetwork MonitoringSQLAnomaly DetectionMITRE ATT&CK FrameworkThreat ModelingComputer Security Incident ManagementNetwork SecurityMalware ProtectionThreat ManagementCyber Threat IntelligenceIncident ResponseNetwork ProtocolsEvent MonitoringIntrusion Detection and PreventionExploitation techniques

Программа курса

4 модулей · 300 учебных материалов

01Understanding Incident Analysis in a Threat-Centric SOC48 материалов

Introduction

Introduction to Understanding Incident Analysis in a Threat-Centric SOCВидеоIntroduction to Understanding Incident Analysis in a Threat-Centric SOCЧтениеLearner IntroductionОбсуждение

Classic Kill Chain Model Overview

Учитесь у экспертов

Cisco Learning & Certifications

Преподаватель курса

Threat Analysis
В каталоге вашей программы

Инвестируйте в себя

Новые знания — в удобное для вас время.

Начать на Coursera

Обучение откроется на Coursera
в новой вкладке

Обучение на Coursera

≈ 26.6 ч

4 модулей

Язык: Английский

Субтитры: Арабский, Французский, Узбекский, Китайский (Китай), Итальянский, Бразильский португальский, Вьетнамский, Корейский, Немецкий, Пушту, Русский, Индонезийский, Испанский, Дари, Хинди, Японский, Малайский

Часть программы вашего университета
Classic Kill Chain Model OverviewВидео
Classic Kill Chain Model OverviewЧтение
Classic Kill Chain Model Overview Practice QuizЗадание

Kill Chain Phase 1: Reconnaissance

Kill Chain Phase 1: ReconnaissanceВидеоKill Chain Phase 1: ReconnaissanceЧтениеKill Chain Phase 1: Reconnaissance Practice QuizЗадание

Kill Chain Phase 2: Weaponization

WeaponizationВидеоWeaponizationЧтениеKill Chain Phase 2: Weaponization Practice QuizЗадание

Kill Chain Phase 3: Delivery

Kill Chain Phase 3: DeliveryВидеоKill Chain Phase 3: DeliveryЧтениеKill Chain Phase 3: Delivery Practice QuizЗадание

Kill Chain Phase 4: Exploitation

Kill Chain Phase 4: ExploitationВидеоKill Chain Phase 4: ExploitationЧтениеKill Chain Phase 4: Delivery Practice QuizЗадание

Kill Chain Phase 5: Installation

Kill Chain Phase 5: InstallationВидеоKill Chain Phase 5: InstallationЧтениеKill Chain Phase 5: Delivery Practice QuizЗадание

Kill Chain Phase 6: Command-and-Control

Kill Chain Phase 6: Command-and-ControlВидеоKill Chain Phase 6: Command-and-ControlЧтениеKill Chain Phase 6: Delivery Practice QuizЗадание

Kill Chain Phase 7: Actions on Objectives

Kill Chain Phase 7: Actions on ObjectivesВидеоKill Chain Phase 7: Actions on ObjectivesЧтениеKill Chain Phase 7: Delivery Practice QuizЗадание

Applying the Kill Chain Model

Applying the Kill Chain Model ВидеоApplying the Kill Chain Model ЧтениеApplying the Kill Chain Model Practice QuizЗадание

Diamond Model Overview

Diamond Model OverviewВидеоDiamond Model OverviewЧтениеDiamond Model Overview Practice QuizЗадание

Applying the Diamond Model

Applying the Diamond ModelВидеоApplying the Diamond ModelЧтениеApplying the Diamond Model Practice ExamЗадание

MITRE ATTACK™ Framework

Topic IntroductionЧтениеPyramid of PainЧтениеGetting Started with the MITRE ATT&CK FrameworkЧтениеEnterprise ATT&CK Matrix ComponentsЧтениеMITRE ATT&CK Matrices and TacticsЧтениеMITRE ATT&CK Techniques and Strategies for Detection and MitigationЧтениеMITRE ATT&CK Navigator Web ApplicationЧтениеCreate A Threat Model Using ATT&CK FrameworkЧтениеMITRE ATTACK™ Framework Practice ExamЗадание

Wrap-Up

Wrap-UpЧтениеWrap-UpВидео

Course Exam

Understanding Incident Analysis in a Threat-Centric SOC Course ExamЗадание
02Identifying Common Attack Vectors124 материалов

Introduction

Introduction to Identifying Common Attack VectorsЧтениеIntroduction to Identifying Common Attack VectorsВидео

DNS Operations

DNS OperationsЧтениеDNS OperationsВидеоDNS MappingsЧтениеDNS PortsЧтениеDNS Distributed DatabaseЧтениеDNS TerminologyЧтениеDNS RR TypesЧтениеThe nslookup UtilityЧтениеDNS Operations Practice ExamЗадание

Dynamic DNS

Dynamic DNSЧтениеDynamic DNSВидеоDDNS OperationsЧтениеDynamic DNSЧтениеDynamic DNS Practice ExamЗадание

Recursive DNS Query

Topic IntroductionЧтениеRecursive DNS QueryВидеоRecursive DNS QueryЧтениеRecursive DNS Query Practice ExamЗадание

HTTP Operations

Topic IntroductionЧтениеHTTP OperationsВидеоHTTP Protocol FundamentalsЧтениеURI and URLЧтениеHTTP Request MethodsЧтениеHTTP Request and Response Packets Capture ExampleЧтениеHTTP Status Codes

HTTPS Operations

HTTPS OperationsЧтениеHTTPS OperationsВидеоTopic IntroductionЧтениеHTTPS OperationsЧтениеWeb Server Digital CertificateЧтениеHTTPS Operations Practice ExamЗадание

HTTP/2 Operations

Topic IntroductionЧтениеHTTP/2 OperationsЧтениеHTTP/2 StreamsЧтениеHTTP/2 Version IdentificationЧтениеOther Features of HTTP/2ЧтениеHTTP/2 PCAP ExampleЧтениеHTTP/2 VulnerabilitiesЧтение

SQL Operations

SQL OperationsЧтениеSQL OperationsВидеоTopic IntroductionЧтениеSQL CommandsЧтениеSQL Operations Practice ExamЗадание

SMTP Operations

SMTP OperationsЧтениеSMTP OperationsВидеоTopic IntroductionЧтениеSMTP TerminologyЧтениеSMTP FlowЧтениеSMTP ConversationЧтениеSMTP Operations Practice ExamЗадание

Web Scripting

Web ScriptingЧтениеWeb ScriptingВидеоWeb ScriptingЧтениеWeb ScriptingЧтениеServer-Side and Client-Side Scripting ЧтениеWeb Scripting Practice ExamЗадание

Obfuscated JavaScript

Obfuscated JavaScriptВидеоTopic IntroductionЧтениеObfuscated JavaScriptЧтениеObfuscated JavaScript Practice ExamЗадание

Shellcode and Exploits

Shellcode and ExploitsЧтениеShellcode and ExploitsВидеоTopic IntroductionЧтениеShellcode and Exploits Practice ExamЗадание

Common Metasploit Payloads

Common Metasploit PayloadsЧтениеCommon Metasploit PayloadsВидеоSinglesЧтениеStagersЧтениеStagesЧтениеOther PayloadsЧтениеCommon Metasploit Payloads Practice ExamЗадание

Directory Traversal

Directory TraversalЧтениеDirectory TraversalВидеоTopic IntroductionЧтениеDirectory Traversal Practice ExamЗадание

SQL Injection

SQL InjectionЧтениеSQL InjectionВидеоTopic IntroductionЧтениеIntrusion Prevention System SignaturesЧтениеSQL Injection Practice ExamЗадание

Cross-Site Scripting

Cross-Site Scripting ЧтениеCross-Site Scripting ВидеоTopic IntroductionЧтениеCross-Site Scripting ЧтениеCross-Site Scripting Practice ExamЗадание

Punycode

PunycodeЧтениеPunycodeВидеоTopic IntroductionЧтениеPunycode Practice ExamЗадание

DNS Tunneling

DNS TunnelingЧтениеDNS TunnelingВидеоTopic IntroductionЧтениеDNS Tunneling Practice ExamЗадание

Pivoting

PivotingЧтениеPivotingВидеоTopic IntroductionЧтениеPivoting Practice ExamЗадание

HTTP 302 Cushioning

HTTP 302 CushioningЧтениеHTTP 302 CushioningВидеоTopic IntroductionЧтениеHTTP 302 CushioningЧтениеHTTP 302 Cushioning Practice ExamЗадание

Gaining Access Via Web-Based Attacks

Gaining Access Via Web-Based AttacksЧтениеGaining Access Via Web-Based AttacksВидеоTopic IntroductionЧтениеGaining Access Via Web-Based Attacks Practice ExamЗадание

Exploit Kits

Exploit KitsЧтениеExploit KitsВидеоTopic IntroductionЧтениеExploit KitsВидеоExploit KitsЧтениеExploit KitsЧтениеExploit Kits Practice ExamЗадание

Emotet Advanced Persistent Threat

Emotet Advanced Persistent ThreatЧтениеEmotet Advanced Persistent Threat Practice ExamЗадание

Wrap-Up

Wrap-UpЧтениеWrap-UpВидео

Course Exam

Identifying Common Attack Vectors Course ExamЗадание
03Identifying Malicious Activity110 материалов

Introduction

Introduction to Identifying Malicious ActivityЧтениеIntroduction to Identifying Malicious ActivityВидеоLearner IntroductionОбсуждение

Understanding the Network Design

Understanding Network DesignВидеоTopic IntroductionЧтениеUnderstanding the Network Design Practice QuizЗадание

Zero Trust Model

Topic IntroductionЧтениеZero Trust Workforce ProtectionsЧтениеZero Trust Workload ProtectionsЧтениеZero Trust Workplace ProtectionsЧтениеZero Trust Model Security VisionЧтениеZero Trust Model Practice QuizЗадание

Identifying Possible Threat Actors

Identifying Possible Threat ActorsВидеоTopic IntroductionЧтениеScript KiddiesЧтениеHacktivistsЧтениеOrganized CrimeЧтениеState-Sponsored/Nation-State ActorsЧтениеInsider Threat

Log Data Search

Log Data SearchВидеоTopic IntroductionЧтениеModeling Network AttacksЧтениеLog Data Search Practice QuizЗадание

System Logs

System LogsВидеоSystem LogsЧтениеLog File Locations and Log FilesЧтениеConfiguring SyslogЧтениеSelector SyntaxЧтениеAction SyntaxЧтениеPractice QuizЗадание

Windows Event Viewer

Windows Event ViewerВидеоWindows Event ViewerЧтениеSystem Logs Practice QuizЗадание

Firewall Log

Firewall LogВидеоFirewall LogЧтениеFirewall Log Practice QuizЗадание

DNS Log

DNS LogВидеоDNS LogЧтениеDNS Log Practice QuizЗадание

Web Proxy Log

Web Proxy LogВидеоWeb Proxy LogЧтениеWeb Proxy Log Practice QuizЗадание

Email Proxy Log

Email Proxy LogВидеоEmail Proxy LogЧтениеEmail Proxy Log Practice QuizЗадание

AAA Server Log

AAA Server LogВидеоAAA Server LogЧтениеAAA Server Log Practice QuizЗадание

Next Generation Firewall Log

Next Generation Firewall LogВидеоNext Generation Firewall LogЧтениеNext Generation Firewall Log Practice QuizЗадание

Applications Log

Applications LogВидеоApplications LogЧтениеApplications Log Practice QuizЗадание

NetFlow

NetFlowВидеоNetFlowЧтениеNetFlowЧтениеReferencesЧтениеNetflow Practice QuizЗадание

NetFlow as a Security Tool

NetFlow as a Security ToolВидеоNetFlow as a Security ToolЧтениеNetwork as a SensorЧтениеNetFlow as Security Tool Examples ЧтениеNetFlow as a Security Tool Practice QuizЗадание

Network Behavior Anomaly Detection

Network Behavior Anomaly DetectionВидеоNetwork Behavior Anomaly DetectionЧтениеNetwork Behavior Anomaly Detection Practice QuizЗадание

Data Loss Detection Using NetFlow Example

Data Loss Detection Using NetFlow ExampleВидеоData Loss Detection Using NetFlow ExampleЧтениеData Loss Detection Using NetFlow Example Practice QuizЗадание

DNS Risk and Mitigation Tool

DNS Risk and Mitigation ToolВидеоDNS Risk and Mitigation ToolЧтениеFast Flux and BotnetsЧтениеDouble IP FluxЧтениеDomain Generation AlgorithmЧтениеDNS Risk and Mitigation Tool Practice QuizЗадание

IPS Evasion Techniques

IPS Evasion TechniquesВидеоIPS Evasion TechniquesЧтениеTraffic FragmentationЧтениеTraffic Substitution and InsertionЧтениеEncryption and TunnelingЧтениеProtocol-Level MisinterpretationЧтениеResource Exhaustion

The Onion Router

The Onion RouterЧтениеTor RelaysЧтениеDetecting Tor TrafficЧтениеThe Onion Router Practice QuizЗадание

Gaining Access and Control

Gaining Access and ControlВидеоGaining Access and ControlЧтениеNyetya Ransomware EventЧтениеGaining Access and Control Practice QuizЗадание

Peer-to-Peer Networks

Peer-to-Peer NetworksЧтениеBitTorrent ApplicationЧтениеRisks of P2P File SharingЧтениеBotnetsЧтениеDetecting Malicious Encrypted P2P TrafficЧтениеPeer-to-Peer Networks Practice QuizЗадание

Encapsulation

EncapsulationЧтениеDNS TunnelsЧтениеOther TunnelsЧтениеEncapsulation Practice QuizЗадание

Altered Disk Image

Altered Disk ImageЧтениеSoftware Image VerificationЧтениеSecure BootЧтениеAltered Disk ImageЗадание

Wrap-Up

Wrap-UpЧтениеWrap-UpВидео

Course Exam

Identifying Malicious ActivityЗадание
04Identifying Patterns of Suspicious Behavior18 материалов

Introduction

IntroductionВидеоIЧтение

Network Baselining

Network BaseliningВидеоNetwork BaseliningЧтениеCore Baseline ProcessЧтениеNetwork Baselining Practice QuizЗадание

Identifying Anomalies and Suspicious Behaviors

Identify Anomalies and Suspicious Behaviors ВидеоIdentifying Anomalies and Suspicious BehaviorsЧтениеIdentifying Anomalies and Suspicious Behaviors Practice QuizЗадание

PCAP Analysis

PCAP Analysis ВидеоPCAP AnalysisЧтениеPCAP Analysis Practice QuizЗадание

Delivery

Delivery ВидеоDeliveryЧтениеDelivery Practice QuizЗадание

Wrap-Up

Wrap-UpЧтениеWrap-UpВидео

Course Exam

Identifying Patterns of Suspicious Behavior Course ExamЗадание
Чтение
HTTP CookiesЧтение
HTTP RefererЧтение
HTTP Operations Practice ExamЗадание
HTTP/2 Operations Practice ExamЗадание
Чтение
Чтение
Timing AttacksЧтение
IPS Evasion Techniques Practice QuizЗадание