SEC555: SIEM with Tactical Analytics

GIAC Certified Detection Analyst (GCDA)
GIAC Certified Detection Analyst (GCDA)
  • Online
46 CPEs
Many organizations have logging capabilities but lack the people and processes to analyze them. In addition, logging systems collect vast amounts of data from a variety of data sources which require an understanding of the sources for proper analysis. This class is designed to provide training, methods, and processes for enhancing existing logging solutions. This class will also provide the understanding of the when, what, and why behind the logs. This is a lab-heavy course that utilizes SOF-ELK, a SANS-sponsored free SIEM solution, to train hands-on experience and provide the mindset for large-scale data analysis.

What You Will Learn

Many organizations have logging capabilities but lack the people and processes to analyze it. In addition, logging systems collect vast amounts of data from a variety of data sources which require an understanding of the sources for proper analysis. This class is designed to provide individuals training, methods, and processes for enhancing existing logging solutions. This class will also provide the understanding of the when, what, and why behind the logs. This is a lab heavy course that utilizes the open-source Elasticsearch, Logstash, and Kibana (ELK) Stack along with additional open-source projects to provide the class with a SIEM solution, to train hands on experience and provide the mindset for large scale data analysis.

Today, security operations do not suffer from a "Big Data" problem but rather a "Data Analysis" problem. Let's face it, there are multiple ways to store and process large amounts of data without any real emphasis on gaining insight into the information collected. Added to that is the daunting idea of an infinite list of systems from which one could collect logs. It is easy to get lost in the perils of data saturation. This class is the switch from the typical churn and burn log systems, to achieving actionable intelligence and developing a tactical Security Operations Center (SOC).

This course is designed to demystify the Security Information and Event Management (SIEM) architecture and process, by navigating the student through the steps of tailoring and deploying a SIEM to full Security Operations Center (SOC) integration. The material will cover many bases in the "appropriate" use of a SIEM platform to enrich readily available log data in enterprise environments and extract actionable intelligence. Once collected, the student will be shown how to present the gathered input into useable formats to aid in eventual correlation. Students will then iterate through the log data and events to analyze key components that will allow them to learn how rich this information is, how to correlate the data, start investigating based on the aggregate data, and finally, how to go hunting with this newly gained knowledge. They will also learn how to deploy internal post-exploitation tripwires and breach canaries to nimbly detect sophisticated intrusions. Throughout the course, the text and labs will not only show how to manually perform these actions, but how to automate many of the processes mentioned so students may employ these tasks the day they return to the office.

The underlying theme is to actively apply Continuous Monitoring and analysis techniques by utilizing modern cyber threat attacks. Labs will involve replaying captured attack data to provide real world results and visualizations.

Business Takeaways

This course will help your organization:

  • Use log data to establish security control effectiveness
  • Combine data into active dashboards that make analyst review more tactical
  • Simplify the handling and filtering of the large amount of data generated by both servers and workstations
  • Apply large data analysis techniques to sift through massive ammounts of endpoint data
  • Quickly detect and respond to the adversary

This Course Will Prepare You To:

  • Demonstrate ways most SIEMs commonly lag current open-source solutions (e.g. ELK)
  • Bring students up to speed on SIEM use, architecture, and best practices
  • Know what type of data sources to collect logs from
  • Deploy a scalable logs solution with multiple ways to retrieve logs
  • Operationalize ordinary logs into tactical data
  • Develop methods to handle billions of logs from many disparate data sources
  • Understand best practice methods for collecting logs
  • Dig into log manipulation techniques challenging many SIEM solutions
  • Build out graphs and tables that can be used to detect adversary activities and abnormalities
  • Combine data into active dashboards that make analyst review more tactical
  • Utilize adversary techniques against them by using frequency analysis in large data sets
  • Develop baselines of network activity based on users and devices
  • Develop baselines of Windows systems with the ability to detect changes from the baseline
  • Apply multiple forms of analysis such as long tail analysis to find abnormalities
  • Correlate and combine multiple data sources to achieve more complete understanding
  • Provide context to standard alerts to help understand and prioritize them
  • Use log data to establish security control effectiveness
  • Implement log alerts that create virtual tripwires for early breach detection
  • Understand how to handle container monitoring and log collection
  • Baseline and find unauthorized changes in cloud environments
  • Integrate and write custom scripts against a SIEM

SEC555 reinforces knowledge transfer by having many hands-on labs. This goes well beyond the traditional lecture and delves into literal application of techniques. Labs are wide ranging such as:

  • Log collection
  • Log augmentation and enrichment
  • Windows log analysis
  • System and network baseline
  • Daily Immersive "Bootcamp Style" Cyber Challenges utilizing the NetWars-based game engine, to build on to the daily class lecture by diving into hands on labs going deeper into the concepts discussed
  • NetWars-based Final Capstone called Defend the Flag (DTF) designed to test the students understanding of the course material in a team centric question and answer game through students demonstrating their ability to ingest, parse and process logs and utilize the SIEM to hunt for indicators and threats

The SEC555 Workbook provides a step by step guide to learning and applying hands on techniques but also provides a "challenge yourself" approach for those who want to stretch their skills and see how far they can get without following the guide. This allows students of varying backgrounds to pick a difficulty and always have a frustration free fallback path.

To make learning go from great to awesome days one through five include a SEC555 custom NetWars experience. This game engine provides a fun and entertaining way to reinforce skills and learn concepts. It also provides a fun excuse to give students more hands on experience, a key component often missing in organizations.

What You Will Receive

  • Custom distribution of the Linux SANS SOF-ELK Virtual Machine containing pre-built logging filters, visualizations, and active dashboards
  • Realistic log data and packet captures from multiple data sources including:
    • Windows event logs
    • DNS logs
    • HTTP logs
    • x509 certificate logs from Bro
    • NetFlow data
    • Packet captures to replay through IDS as well as captured logs
  • MP3 audio files of the complete course lecture
  • Intro and walkthrough videos of labs
  • Documentation to implement SOF-ELK in your environment
  • A Digital Download Package that includes the above and more

Syllabus (46 CPEs)

Download PDF
  • Overview

    Logging and analysis is a critical component in cyber network defense and allows for both reactive and proactive detection of adversarial activities. When properly utilized it becomes the backbone for agile detection as well as provides understanding to the overall environment. Logging and analysis products and techniques have been around for many years and are quickly gaining more and more functionality. This section will introduce free logging and analysis tools and focus on techniques to make sense of and augment traditional logs. It also covers how to handle the big data problem of handling billions of logs and how advances in free tools are starting to give commercial solutions a run for their money.

    Day one is designed to bring all students up to speed on SIEM concepts and to bring all students to a base level to carry them through the rest of the class. It is designed to also cover SIEM best practices. During day one we will be introducing Elasticsearch, Logstash, and Kibana within SOF-ELK (a VM co-maintained by Phil Hagen and Justin Henderson) and immediately go into labs to get students comfortable with ingesting, manipulating, and reporting on log data.

    • State of the SOC/SIEM
      • Industry statistics
      • Industry problems
    • Log Monitoring
      • Assets
        • Windows/Linux
        • Network devices
        • Security devices
      • Data gathering strategies
      • Pre-planning
    • Logging architecture
      • Log inconsistencies
      • Log collection and normalization
      • Log retention strategies
      • Correlation and gaining context
      • Reporting and analytics
      • Alerting
    • SIEM platforms
      • Commercial solutions
      • Home-grown solutions
    • Planning a SIEM
      • Ingestion control
      • What to collect
      • Mission
    • SIEM Architecture
    • Ingestion techniques and nodes
      • Acceptance and manipulation for value
      • Augmentation of logs for detection
    • Data queuing and resiliency
    • Storage and speed
    • Analytical reporting
      • Visualizations
      • Detection Dashboards
  • Overview

    A vast majority of network communication occurs over key network protocols and yet it is uncommon for organizations to use or collect this data. The sheer volume can be overwhelming. However, these common data sources provide an opportunity in identifying modern day attacks.

    This section covers how to collect and handle this massive amount of data. Methods for collecting these logs through service logs such as from DNS servers will be covered as well as passive ways of pulling the same data from the network itself. Techniques will be demonstrated to augment and add valuable context to the data as it is collected.

    Finally, analytical principles will be covered for finding the needles in the stack of needles. We will cover how even if we have the problem of searching through billions of logs that we can surface only meaningful items of interest. Active dashboards will be designed to quickly find the logs of interest and to provide analysts with additional context for what to do next.

    • Detection methods and relevance to log analysis
      • Attacker patterns
      • Attacker behaviors
      • Abnormalities
    • Analyzing common application logs that generate tremendous amounts of data
      • DNS
        • Finding new domains being accessed
        • Pulling in addition information such as domain age
        • Finding randomly named domains
        • Discover domain shadowing techniques
        • Identifying recon
        • Find DNS C2 channels
      • HTTP
        • Use large datasets to find attacks
        • Identify bot traffic hiding in the clear
        • Discover requests that users do not make
          • Find ways to filter out legitimate noise
        • Use attacker randomness against them
        • Identify automated activity vs user activity
        • Filter approved web clients vs unauthorized
        • Find HTTP C2 channels
      • HTTPS
        • Alter information for large scale analysis
        • Analyze certificate fields to identify attack vectors
        • Track certificate validity
        • Apply techniques that overlap with standard HTTP
        • Find HTTPS C2 channels
      • SMTP
        • Identify where unauthorized email is coming from
        • Find compromised mail services
        • Fuzzy matching likely phishing domains
        • Data exfiltration detection
    • Apply threat intelligence to generic network logs
    • Active Dashboards and Visualizations
      • Correlate network datasets
      • Build frequency analysis tables
      • Establish network baseline activity
  • Overview

    The value in endpoint logs provides tremendous visibility in detecting attacks. Especially, in regards to finding post compromise activity, endpoint logs can quickly become second to none. However, logs even on a single desktop can range in the tens if not hundreds of thousand events per day. Multiply this by the number of systems in your environment and it is no surprise why organizations get overwhelmed.

    This section will cover the how and more importantly the why behind collecting system logs. Various collection strategies and tools will be used to gain hands on experience and to provide simplification with handling and filtering the seemingly infinite amount of data generated by both servers and workstations.

    Workstations log strategies will be covered in depth due to their value in today's modern attack vectors. After all, modern day attacks typically start and then spread from workstations.

    • Endpoint logs
      • Understanding value
      • Methods of collection
        • Agents
        • Agentless
        • Scripting
      • Adding additional logging
        • EMET
        • Sysmon
        • Group Policy
      • Windows filtering and tuning
      • Analyze critical events based on attacker patterns
        • Finding signs of exploitation
        • Find signs of internal reconnaissance
        • Finding persistence
        • Privilege escalation
        • Establishing a foothold
        • Cleaning up tracks
      • Host-based firewall logs
        • Discover internal pivoting
        • Identify unauthorized listening executables
        • See scan activity
      • Credential theft and reuse
        • Multiple failed logons
        • Unauthorized account use
      • Monitor PowerShell
        • Configure PowerShell logging
        • Identify obfuscation
        • Identify modern attacks
      • Containers
        • Logging methods
        • Monitoring
  • Overview

    Know thyself is often quoted to defenders as a key defense strategy. And yet this one of the most difficult things to accomplish. Take something such as having a list of all assets in an organization and knowing if any non-company assets are on the network. The task sounds simple but ends up being incredibly difficult to maintain in today's ever evolving networks.

    This section focuses on applying techniques to automatically maintain a list of assets and their configurations as well as methods to distinguish if they are authorized vs unauthorized. Key locations to provide high fidelity data will be covered and techniques to correlate and combine multiple sources of data together will be demonstrated to build a master inventory list.

    Other forms of knowing thyself will be introduced such as gaining hands on experience in applying network and system baselining techniques. We will monitor network flows and identify abnormal activity such as C2 beaconing as well as look for unusual user activity.

    Finally, we will apply large data analysis techniques to sift through massive amounts of endpoint data. This will be used to find things such as unwanted persistence mechanisms, dual-homed devices, and more.

    • Identify authorized and unauthorized assets

      • Active asset discovery
        • Scanners
        • Network Access Control
      • Passive asset discovery
        • DHCP
        • Network listeners such as p0f, bro, and prads
        • NetFlow
        • Switch CAM tables
      • Combining asset inventory into a master list
      • Adding contextual information
        • Vulnerability data
        • Authenticated device vs unauthenticated device
    • Identify authorized and unauthorized software
      • Source collection
        • Asset inventory systems
        • Patching management
        • Whitelisting solutions
        • Process monitoring
      • Discovering unauthorized software
    • Baseline data
      • Network data (from netflow, firewalls, etc)
        • Use outbound flows to discover unauthorized use or assets
        • Compare expected inbound/outbound protocol
        • Find persistence and beaconing
        • Utilize geolocation and reverse dns lookups
        • Establish device-to-device relationships
        • Identify lateral movement
        • Configure outbound communication thresholds
      • Monitor logons based on patterns
        • Time-based
        • Concurrency of logons
          • # logons by user
          • # logons by source device
          • Multiple geo locations
      • Endpoint baseline monitoring
        • Configure enterprise wide baseline collection
        • Large scale persistence monitoring
        • Finding abnormal local user accounts
        • Discover dual-homed devices
      • Cloud baselining (Example in class uses Amazon AWS)
  • Overview

    Multiple security devices exist but often are designed to be independent. Analysts are commonly divided into specialty areas and focus on their respective area such as a network intrusion detection system. However, alerts from a single security device lack context and are akin to the common analogy of "looking up from the bottom of a well".

    This section focuses on combining multiple security logs for central analysis. More importantly we will cover methods for combining multiple sources to provide improved context to analysts. We will also show how providing context with asset data can help prioritize analyst time, saving money and addressing risks that matter.

    After covering ways to optimize traditional security alerts we will jump into new methods to utilize logging technology to implement virtual tripwires. While it would be ideal to prevent attacker's from gaining access to your network it is a given that at some point you will be compromised. However, compromise is just the beginning and not the end goal. Adversaries will crawl your systems and network to achieve their own ends. Knowing this we will implement logging based tripwires that should a single one be "stepped on" we can quickly detect and respond to the adversary.

    • Centralize NIDS and HIDS alerts
    • Analyze endpoint security logs
      • Provide alternative analysis methods
      • Configure tagging to facilitate better reporting
    • Augment intrusion detection alerts
      • Extract CVE, OSVDB, etc for further context
      • Pull in rule info and other info such as geo
    • Analyze vulnerability information
      • Setup vulnerability reports
      • Correlate CVE, OSVDB, and other unique IDs with IDS alerts
      • Prioritize IDS alerts based on vulnerability context
    • Correlate malware sandbox logs with other systems to identify victims across enterprise
    • Monitor Firewall Activity
      • Identify scanning activity on inbound denies
      • Apply auto response based on alerts
      • Find unexpected outbound traffic
      • Baseline allow/denies to identify unexpected changes
      • Apply techniques to filter out noise in denied traffic
    • SIEM tripwires
      • Configure systems to generate early log alerts after compromise
        • Identify file and folder scan activity
        • Identify user token stealing
        • Operationalize virtual honeypots with central logging
        • Allow phone home tracking
    • Post mortem analysis
      • Re-analyze network traffic
        • Identify malicious domains and IPs
        • Look for beaconing activity
      • Identify unusual time-based activity
      • Use threat intel to reassess previous data fields such as user-agents
      • Utilize hashes in log to constantly re-evaluate for known bad files
  • Overview

    The course culminates in a team-based design, detect, and defend the flag competition. Powered by NetWars, day six provides a full day of hands-on work applying the principles taught throughout the week.

    Your team will progress through multiple levels and missions designed to ensure mastery of the modern cyber defense techniques promoted all week long. From building a logging architecture, augmenting logs, analyzing network logs, analyzing system logs, and developing dashboards to find attacks, this challenging exercise will reinforce key principles in a fun, hands-on, team-based challenge.

    • Defend-the-Flag Challenge - Hands-on Experience

GIAC Certified Detection Analyst

The GIAC Certified Detection Analyst (GCDA) certification proves an individual knows how to collect, analyze, and tactically use modern network and endpoint data sources to detect malicious or unauthorized activity.

  • SIEM Architecture and SOF-ELK
  • Service Profiling, Advanced Endpoint Analytics, Baselining and User Behavior Monitoring
  • Tactical SIEM Detection and Post-Mortem Analysis
More Certification Details


A basic understanding of TCP/IP, logging methods and techniques, and general operating system fundamentals. Moderate familiarization with logging systems (both network and host), messaging queues, be accustomed to command-line activity, and commercial/open source SIEM solutions is a bonus.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

  • CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
  • CRITICAL: Apple systems using the M1/M2 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
  • 8GB of RAM or more is required.
  • 25GB of free storage space or more is required.
  • At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
  • Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
  • Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
  • Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
  • On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
  • Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

If you have additional questions about the laptop specifications, please contact support.

Register for SEC555

Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.