SEC511: Continuous Monitoring and Security Operations

GIAC Continuous Monitoring Certification (GMON)
GIAC Continuous Monitoring Certification (GMON)
  • In Person (6 days)
  • Online
48 CPEs
This course assesses the current state of security architecture and continuous monitoring, and provides a new approach to security architecture that can be easily understood and defended. When students finish, they have a list of action items in hand for making their organization one of the most effective vehicles for frustrating adversaries. Students are able to assess deficiencies in their own organization's security architectures and affect meaningful changes that are continuously monitored for deviations from their expected security posture. 21 Hands-On Labs + Capstone

What You Will Learn

Attackers Evolve; Technology Shifts; Defenses Must Continuously Adapt to Thrive

Cloud (AWS/Azure/Microsoft 365/Serverless), DevOps, Hybrid, Zero Trust, XDR, Blockchain, AI + ML… The pace of technological change continues to increase. Defending your organization as you did 5 years ago is a recipe for failure. However, chasing the latest trend or shiny new tool rarely leads to successful protection. Successfully defending a modern enterprise requires nimble pragmatism.

Defending an enterprise has never been easy. SANS SEC511 provides defenders with the necessary knowledge, skills, and abilities to protect and monitor a modern hybrid enterprise successfully. The Defensible Security Architecture, Network Security Monitoring (NSM)/Continuous Diagnostics and Mitigation (CDM)/Continuous Security Monitoring (CSM) taught in this course will best position your organization or Security Operations Center (SOC) to analyze threats and detect anomalies that could indicate cybercriminal behavior. SEC511 applies these core protection practices to AWS, Azure, and on-premises environments. Achieving the accompanying GIAC GMON certification demonstrates your understanding and application of modern defensive techniques.

Protecting and continuously monitoring a modern enterprise requires accounting for multiple public cloud providers, continued on-premises infrastructure, and possibly a substantial number of remote workers who are not behind a traditional security perimeter.

Security teams failing to adapt to and evolve with the new realities facing our increasingly hybridized organizations risk employing outmoded mental models and inadequate tactics. Continuous monitoring requires security teams to continuously evolve. Many organizations make the key mistake of focusing on cloud security while letting on-premises security lag (or vice-versa). Both needs must be properly balanced. Adversaries constantly evolve techniques to ensure their continued success; we must adapt our defenses to this changing threat landscape.

Business Takeaways

This course will help your organization:

  • Enable effective cloud, network, and endpoint protection and detection strategies
  • Design defensible security architecture and operations for modern hybrid enterprises
  • Materially improve your organization's security operations capabilities
  • Identify protection and detection gaps across hybrid infrastructure
  • Maximize the capabilities of current infrastructure and assets
  • Make sense of data to enable the detection of potential intrusions or unauthorized actions rapidly

This course will prepare you to

  • Analyze modern hybrid enterprises for deficient protection/detection strategies
  • Apply the principles learned in the course to design a defensible cloud, network, and endpoint security architecture and operations
  • Understand the importance of detection-dominant security architecture and Security Operations Centers (SOC) for hybrid enterprises
  • Identify the key components of cloud, network, and endpoint protection and monitoring across hybrid infrastructure
  • Determine appropriate security monitoring needs for organizations of all sizes

While the above list briefly outlines the knowledge and skills you will learn, it barely scratches the surface of what this course has to offer. Hands-on elements incorporated throughout the course will reinforce key concepts and principles.

SEC511 employs several different hands-on tactics that go well beyond simple lecture and instructor-led discussions; here is a sampling:

  • Egress Analysis with Elastic Stack
  • Passively decrypting TLS
  • DNS over HTTPS (DoH)
  • PCAP carving with Zeek
  • Suspicious TLS analysis with Suricata
  • Honey Tokens for breach detection
  • Application Control via AppLocker
  • Detecting WMI-based attacks, including Impacket
  • Sysmon Merlin C2 Analysis
  • Cobalt Strike detection and analysis
  • Analyzing the deadliest Windows events
  • Daily Immersive Cyber Challenges (NetWars game engine)
  • NetWars-based Final Capstone

The meticulously crafted SEC511 Electronic Workbook serves as the starting point for hands-on elements in the course. It includes Security Onion 2, the Elastic Stack, and a lot more. The workbook-driven labs include multiple paths to complete each exercise. This multifaceted approach allows the labs to better accommodate diverse student backgrounds and technical exposure.

Shall we play a game?

The NetWars game engine now permeates every single day of the course! Since the launch of SEC511, students have consistently found the NetWars-based Final Capstone to be great fun. Who would have guessed that a game would be fun, right? Students' praise did not stop at "fun" - they also found the game to be a tremendously successful way to further their learning. Taking this cue, we now incorporate a game-style environment into every day, not just day six.

What Will You Receive

  • Access to custom cloud-hosted challenges to further understanding
  • MP3 audio files of the complete course lecture
  • Licensed Windows 10 virtual machine
  • A Linux VM loaded with tons of extra logs, PCAPs, and other resources
  • A Digital Download Package that includes the above and more

What Comes Next?

Syllabus (48 CPEs)

Download PDF
  • Overview

    The prevention-dominant security model has failed. Given the frequency and extent of significant intrusions, this should not come as a surprise. To address the root of the problem, we must understand the current architecture and the design gaps that facilitate the adversary's dominance. What do we need to address to begin to make things better? Can we ever hope to win? What would winning look like? These are important questions that we must answer if we hope to substantially improve our security posture.

    We begin with the end in mind and define the key techniques and principles that will allow us to achieve that state. An effective modern Security Operations Center or Security Architecture must enable an organization's ability to rapidly find intrusions to facilitate containment and response. Both significant knowledge and a commitment to continuous monitoring are required to achieve this goal.

    • Detecting Traditional Attack Techniques with Security Onion and CyberChef
    • Detecting Modern Attack Techniques with Security Onion
    • Egress Analysis with Elastic Stack
    • NetWars (Day 1): Immersive Cyber Challenges
    • Traditional Security Architecture
      • Perimeter-focused
      • Addressed Layer 3/4
      • Centralized Information Systems
      • Prevention-Oriented
      • Device-driven
      • Traditional Attack Techniques
    • Introducing Security Onion 2.X
      • Alerts Menu
      • Pivoting to the Hunt Menu
      • The PCAP Menu
    • Modern Security Architecture Principles
      • Detection-oriented
      • Post-Exploitation-focused
      • Decentralized Information Systems/Data
      • Risk-informed
      • Layer 7 Aware
      • Security Operations Centers
      • Network Security Monitoring
      • Continuous Security Monitoring
      • Modern Attack Techniques
      • Adversarial Dominance
    • Security Architecture - Key Techniques/Practices
      • Threat Vector Analysis
      • Data Exfiltration Analysis
      • Detection Dominant Design
      • Intrusion Kill Chain
      • Visibility Analysis
      • Lateral Movement Analysis
      • Data Ingress/Egress Mapping
      • Internal Segmentation
      • Network Security Monitoring
      • Continuous Security Monitoring
    • Cloud Deployment Models
      • Cloud Shared Responsibilities
      • Infrastructure as Code (IaC)
      • Overexposed Cloud Services: Leaky Buckets
      • Cloud Network Visibility
    • MITRE ATT&CK(R) & AWS Security Stack
      • AWS Security Hub
      • AWS Identity and Access Management (IAM)
      • AWS CloudTrail
      • Amazon CloudWatch
      • AWS Firewall Manager
      • AWS WAF + AWS Shield
      • Amazon Virtual Private Cloud (VPC)
      • Amazon GuardDuty
      • Amazon Inspector
      • Amazon Macie
  • Overview

    Understanding the problems with the current environment and realizing where we need to get to is far from sufficient: we need a detailed roadmap to bridge the gap between the current and desired state. Day two introduces zero trust architecture (ZTA) and details the components of our infrastructure that become part of a defensible network security architecture and SOC. We are long past the days where a perimeter firewall and ubiquitous antivirus was sufficient security. There are many pieces and moving parts that comprise a modern defensible security architecture.

    In addition to discussing technologies like Next-Generation Firewalls, Web Application Firewalls, Malware Detonation Devices, SIEMs, DLP, and Honeypots that may not be found in all organizations, we will focus on repurposing traditional devices such as layer 3/4 firewalls, routers, switches, and NIDS. The goal of this course is not to give you a long list of items to add to the next year's budget, so we will focus on maximizing the capabilities of your current information security architecture, while pointing out new technologies that may offer a compelling return on investment.

    • ModSecurity
    • Decrypting TLS with Wireshark
    • Detecting Adversaries with Protocol Inspection
    • HoneyTokens for Leak Detection
    • NetWars (Day 2): Immersive Cyber Challenges
    • SOCs/Security Architecture - Key Infrastructure Devices
      • Traditional and Next- Generation Firewalls, and NIPS
      • Web Application Firewall
      • Malware Detonation Devices
      • HTTP Proxies, Web Content Filtering, and SSL/TLS Decryption
      • SIEMs, NIDS, Packet Captures, and DLP
      • Honeypots/Honeynets
      • Network Infrastructure - Routers, Switches, DHCP, DNS
      • Threat Intelligence
    • Segmented Internal Networks
      • Routers
      • Internal SI Firewalls
      • VLANs
      • Detecting the Pivot
      • DNS architecture
      • Encrypted DNS including DNS over HTTPS (DoH) and DNS over TLS (DoT)
    • Defensible Network Security Architecture Principles Applied
      • Internal Segmentation
      • Threat Vector Analysis
      • Data Exfiltration Analysis
      • Detection Dominant Design
      • Zero Trust Architecture (Kindervag)
      • Intrusion Kill Chain
      • Visibility Analysis
      • Data Visualization
      • Lateral Movement Analysis
      • Data Ingress/Egress Mapping
  • Overview

    Designing a SOC or security architecture that enhances visibility and detective capabilities represents a paradigm shift for most organizations. However, the design is simply the beginning. The most important element of a modern security architecture is the emphasis on detection. The network security architecture presented in days one and two emphasized baking visibility and detective capabilities into the design. Now we must figure out how to look at the data and continuously monitor the enterprise for evidence of compromise or changes that increase the likelihood of compromise.

    We must first understand the approach and goals of monitoring and define a methodology for analysis. Key terms such as Network Security Monitoring (NSM), Continuous Diagnostics and Mitigation (CDM), and Continuous Security Monitoring (CSM) can cause confusion, and we will make sure these terms are understood, enabling the security professional to guide an organization in using the best practices. Speaking of best practices, we will emphasize the continuous monitoring of the Critical Security Controls.

    Enabling continuous monitoring will be studied by developing a model for employing robust NSM. This will allow an organization to deal with and make sense of data to rapidly enable the detection of potential intrusions or unauthorized actions.

    • Pcap Carving with Zeek
    • Security Onion Service-Side Attack Analysis
    • Wireshark Merlin Analysis
    • Detecting TLS Certificate and User-Agent Anomalies
    • NetWars (Day 3): Immersive Cyber Challenges Labs
    • Evolution of NSM
    • The NSM Toolbox
    • NIDS Design
    • Analysis Methodology
    • Understanding Data Sources
      • Full Packet Capture
      • Extracted Data
      • String Data
      • Flow Data
      • Transaction Data
      • Statistical Data
      • Alert Data
      • Tagged Data
      • Correlated Data
    • Cloud NSM
    • Practical NSM Issues
    • Cornerstone NSM
      • Service-Side and Client-Side Exploits
      • Identifying High-Entropy Strings
      • Tracking EXE Transfers
      • Identifying Command and Control (C2) Traffic
      • Tracking User Agents
      • C2 via HTTPS
      • Tracking Encryption Certificates
      • Detecting Malware via JA3
    • Detecting Cobalt Strike
      • Criminal Usage of Cobalt Strike
      • Malleable C2
      • Cobalt Strikes x.509 Certificates
  • Overview

    One of the hallmarks of modern attacks is an emphasis on client-side exploitation. The days of breaking into networks via direct frontal assaults on unpatched mail, web, or DNS servers are largely behind us. We must focus on mitigating the risk of compromise of clients. Day four details ways in which endpoint systems can be both more resilient to attack and also enhance detective capabilities.

    • Sysmon
    • Autoruns
    • Application Control with AppLocker
    • Merlin Sysmon Analysis
    • NetWars Day 4: Immersive Cyber Challenges
    • Endpoint Security Architecture
      • Endpoint Protection Platforms
      • Endpoint Detection Response
      • Authentication Protection/Detection
      • Configuration Management/Monitoring
    • Endpoint Protection
      • TPM: Device Health Attestation
      • Host-based Firewall, Host-based IDS/IPS
      • Application Control, Application Virtualization
      • Virtualization Based Security
      • Microsoft Defender: Application Guard
      • Windows Defender: Credential Guard
      • Defender for Endpoint: Attack Surface Reduction
      • EMET and Defender Exploit Guard
    • Cloud Configuration Management
    • Endpoint Detection - Sysmon
      • FileDelete, ProcessTampering, and other recent additions
      • IMPHASH
      • DeepBlueHash
    • Authentication Protection and Detection
      • Privileged Account Monitoring
      • Windows Hello
      • Dynamic Lock
      • PIN-Only Authentication
      • Passwordless
      • Azure Active Directory + MFA
      • Azure Authentication Methods
      • AAD Conditional Access
      • Hash/Ticket/Token Attacks
    • Configuration Management/Monitoring
      • Cloud: Center for Internet Security (CIS) Hardened Images
      • Containers: CIS Hardened Images for Containers
      • Baseline Monitoring
      • Desired State Configuration (DSC)
      • Azure Automation State Configuration
  • Overview

    Network Security Monitoring (NSM) is the beginning: we need to not only detect active intrusions and unauthorized actions, but also know when our systems, networks, and applications are at an increased likelihood for compromise. A strong way to achieve this is through Continuous Security Monitoring (CSM) or Continuous Diagnostics and Mitigation (CDM). Rather than waiting for the results of a quarterly scan or an annual penetration test to determine what needs to be addressed, continuous monitoring proactively and repeatedly assesses and reassesses the current security posture for potential weaknesses that need be addressed.

    The volume of data that must be continuously sought and mined is vast: the goal of continuous monitoring would be out of reach without scripting and automation. Naturally, there are vendors and tools to scratch this itch, but they will be incomplete and require their own care, feeding, and monitoring. Day five describes how to perform continuous monitoring with simple tools and scripts. Knowing how to script and automate is pointless unless you know what data should be captured and analyzed on a continuous basis. Again, leaning on the Critical Security Controls, we will determine high-value targets for continuous monitoring in an enterprise.

    • Inventory
    • Windows Event Logs
    • DNS over HTTPS (DoH)
    • Kansa Persistence and Pivoting
    • NetWars (Day 5): Immersive Cyber Challenges

    • Overview
      • Continuous Security Monitoring (CSM) vs. Continuous Diagnostics and Mitigation (CDM) vs. Information Security Continuous Monitoring (ISCM)
      • Cyberscope and SCAP
    • Industry Best Practices
      • Continuous Monitoring and the 20 CIS Critical Security Controls
      • Australian Signals Directorate (ASD) Strategies to Mitigate Targeted Cyber Intrusions
    • Winning CSM Techniques
      • Long Tail Analysis
      • Australian Signals Directorate (ASD) Strategies to Mitigate Cyber Security Incidents
      • The ASD Essential Eight
    • Maintaining Situational Awareness
    • Host, Port, and Service Discovery
    • Vulnerability Scanning
    • Monitoring Patching
    • Monitoring Applications
    • Monitoring Service Logs
      • Detecting Malware via DNS logs
      • Detecting DNS Tunneling via Iodine and dnscat2
      • Domain_stats and Registration Data Access Protocol (RDAP)
    • Monitoring Change to Devices and Appliances
    • Leveraging Proxy and Firewall Data
    • Configuring Centralized Windows Event Log Collection
    • Monitoring Critical Windows Events
      • Hands-on: Detecting Malware via Windows Event Logs
    • Scripting and Automation
      • Importance of Automation
      • PowerShell
      • DeepBlueCLI
    • Security Operations Center (SOC)
      • Purpose of a SOC
      • Key SOC roles
      • Relationship to Defensible Security Architecture
  • Overview

    The course culminates in a team-based design, detect, and defend the flag competition. Powered by NetWars, day six provides a full day of hands-on work applying the principles taught throughout the week.

    Your team will progress through multiple levels and missions designed to ensure mastery of the modern cyber defense techniques promoted all week long. From security architecture, network security monitoring, endpoint security, and continuous monitoring, this challenging exercise will reinforce key principles in a fun, hands-on, team-based challenge.

    • Security Architecture
    • Continuous Security Monitoring
    • Applied NSM and CSM
    • Analyzing Malicious Traffic with Security Onion, Wireshark, and CyberChef
    • Analzying Malicious Windows Event Logs
    • Packet Analysis
    • Log Analysis
    • C2 Detection

GIAC Continuous Monitoring Certification

The GIAC Continuous Monitoring (GMON) certification validates a practitioner's ability to deter intrusions and quickly detect anomalous activity. GMON certification holders have demonstrated knowledge of defensible security architecture, network security monitoring, continuous diagnostics and mitigation, and continuous security monitoring.

  • Security architecture and security operations centers (SOCs)
  • Network security architecture and monitoring
  • Endpoint security architecture, automation, and continuous monitoring
More Certification Details


  • Basic understanding of network protocols and devices
  • Experience with Linux and Windows from the command line

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

  • CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
  • CRITICAL: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
  • 16GB of RAM or more is required.
  • 100GB of free storage space or more is required.
  • At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
  • Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
  • Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
  • Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
  • On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
  • Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact support.

Author Statement

"We are just beginning to accept that every organization can and will be breached. Perimeter-focused preventive security controls have failed. Attackers simply have to find one way into most organizations - the lack of internal security controls then allows them to take their time to achieve their goal.

"This course assesses the current state of security architecture and continuous monitoring, and provides a new approach to security architecture that can be easily understood and defended. What we love most about this course is that when students walk out they have a list of action items in hand to make their organization one of the most effective vehicles for frustrating adversaries. Students are able to assess deficiencies in their own organizations' security architectures and affect meaningful changes that are continuously monitored for deviations from their expected security posture."

- Eric Conrad and Seth Misenar

"SEC511 has not only focused on specific things to learn but has also helped to facilitate a way of thinking analytically." - Calvin Harris, Exelon


The practical applications taught in SEC511 were directly relevant to my day-to-day responsibilities at work
Kevin J
SEC511 alumni
The comprehensive training in SEC511 has opened up numerous job opportunities for me in the cybersecurity sector
Kevin J
SEC511's lab sessions provided critical practical experience that helped solidify the theoretical concepts.
Olivia M
I run SOCs and this course will and does provide a gut check against what we are doing today.
Tim Housman
General Dynamics Information Technology

    Register for SEC511

    Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.