Certified SOC Analyst (CSA) inkl. Examen

EC-Council Certified SOC Analyst (CSA) ist eine spezialisierte Zertifizierung für Tier-1/Tier-2-SOC-Analysten — fokussiert auf praktische SOC-Tools und -Workflows. Themen: 1. SOC Foundations — SOC-Modelle (Internal vs. Outsourced/MSSP, Co-Managed, Hybrid), SOC-Tiers (Tier 1 Triage, Tier 2 Investigation, Tier 3 Threat Hunting + Forensik), SOC-Rollen (Analyst, SOC Manager, Threat Intelligence Analyst, Forensics Investigator). Wichtige Frameworks: NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover), MITRE ATT&CK (Tactics, Techniques, Procedures), Cyber Kill Chain, Diamond Model. 2. Cyber Threats und Threat Intelligence — Threat-Akteur-Kategorien (Nation State, Cybercrime, Hacktivists, Insiders, Script Kiddies), Common Attacks (Phishing, Malware, Ransomware, DDoS, SQL Injection, XSS, Brute Force). Threat Intelligence Sources (OSINT, Commercial Feeds wie Mandiant/Recorded Future/CrowdStrike, ISAC/CERT, Dark Web Monitoring), TI-Lebenszyklus (Planning, Collection, Processing, Analysis, Dissemination, Feedback), Indicators of Compromise (IoCs — Hash, IP, Domain, URL, Email, Mutex, Registry Key), Indicators of Attack (IoAs — TTPs based). 3. Incident Response in SOC — Lifecycle (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned), Triage und Klassifizierung (False Positive, Confirmed Incident, Severity Levels SEV1-4), Escalation Matrix (wann zu Tier 2/3 weitergeben, wann Management informieren), Communication (Stakeholder-Notifications, regulatorische Meldepflichten DSGVO/NIS2). 4. SIEM-Tools — Funktionsweise (Log Collection, Parsing, Normalization, Correlation, Alerting, Dashboards), Marktführer (Splunk, IBM QRadar, Microsoft Sentinel, Elastic Stack, Rapid7 InsightIDR, ArcSight). Splunk vertieft (SPL Search Processing Language, Indexes, Forwarders, Dashboards, Alerting). Use Cases entwickeln (Failed Logins from Same IP, Brute Force Detection, Privilege Escalation, Lateral Movement, Data Exfiltration), Correlation Rules schreiben. Tuning gegen False Positives, Whitelisting. 5. Threat Hunting — Hypothesis-Driven (basierend auf TI oder MITRE-Techniken), Datenquellen (EDR-Logs, Network Traffic, DNS, Authentication), Tools (Splunk, Sentinel Notebooks, Jupyter mit Python). 6. Vulnerability Management — Scanner (Nessus, Qualys, OpenVAS, Rapid7), CVE/CVSS-Bewertung, Patch-Management-Prozess. 7. Endpoint Security — EDR-Tools (CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Cybereason), Konfiguration, Investigation. 8. Network Security — IDS/IPS (Snort, Suricata), Firewall Logs (Palo Alto, Fortinet, Cisco ASA), NetFlow-Analyse. 9. Reporting und Metriken — KPIs (MTTR Mean Time to Respond, MTTD Mean Time to Detect, Detection Coverage gegen ATT&CK), Executive Reports, Compliance-Reporting (PCI DSS, HIPAA, ISO 27001). Hands-on mit Splunk-Demo-Environment und EC-Council iLabs. Examen: 100 Multiple-Choice-Fragen, 3h, 70% Pass.