insoft

Cisco-opplæring

Insoft Services er en av få opplæringsleverandører i EMEAR som tilbyr hele spekteret av Cisco-sertifisering og spesialisert teknologiopplæring.

Les mer

Cisco Sertifisering

Opplev en blandet læringstilnærming som kombinerer det beste av instruktørledet opplæring og e-læring i eget tempo for å hjelpe deg med å forberede deg til sertifiseringseksamen.

Les mer

Cisco Learning Credits

Cisco Learning Credits (CLC) er forhåndsbetalte opplæringskuponger innløst direkte med Cisco som gjør planleggingen for suksessen din enklere når du kjøper Cisco-produkter og -tjenester.

Les mer

Etterutdanning

Cisco Continuing Education Program tilbyr alle aktive sertifiseringsinnehavere fleksible alternativer for å resertifisere ved å fullføre en rekke kvalifiserte opplæringselementer.

Les mer

Cisco Digital Learning

Sertifiserte ansatte er verdsatte eiendeler. Utforsk Ciscos offisielle digitale læringsbibliotek for å utdanne deg gjennom innspilte økter.

Les mer

Cisco Business Enablement

Cisco Business Enablement Partner Program fokuserer på å skjerpe forretningsferdighetene til Cisco Channel Partners og kunder.

Les mer

Cisco opplæringskatalog

Les mer

Fortinet Sertifisering

Fortinet Network Security Expert (NSE)-programmet er et opplærings- og sertifiseringsprogram på åtte nivåer for å lære ingeniører om nettverkssikkerheten for Fortinet FW-ferdigheter og -erfaring.

Tekniske kurs

Fortinet-opplæring

Insoft er anerkjent som Fortinet Autorisert Opplæringssenter på utvalgte steder i EMEA.

Les mer

Fortinet opplæringskatalog

Utforsk et bredt utvalg av Fortinet Schedule på tvers av forskjellige land så vel som online kurs.

Les mer

ATC-status

Sjekk atc-statusen vår på tvers av utvalgte land i Europa.

Les mer

Pakker for Fortinet-tjenester

Insoft Services har utviklet en spesifikk løsning for å effektivisere og forenkle prosessen med å installere eller migrere til Fortinet-produkter.

Les mer

Microsoft-opplæring

Insoft Services gir Microsoft opplæring i EMEAR. Vi tilbyr Microsofts tekniske opplærings- og sertifiseringskurs som ledes av instruktører i verdensklasse.

Tekniske kurs

Extreme-opplæring

Lær eksepsjonell kunnskap og ferdigheter i ekstreme nettverk.

Les mer

Teknisk sertifisering

Vi tilbyr omfattende læreplan over tekniske kompetanseferdigheter om sertifiseringsprestasjonen.

Les mer

Extreme opplæringskatalog

Tekniske kurs

ATP-akkreditering

Som autorisert opplæringspartner (ATP) sørger Insoft Services for at du får de høyeste utdanningsstandardene som er tilgjengelige.

Les mer

Løsninger og tjenester

Vi tilbyr innovativ og avansert støtte for design, implementering og optimalisering av IT-løsninger. Vår kundebase inkluderer noen av de største Telcos globalt.

Les mer

Globalt anerkjent team av sertifiserte eksperter hjelper deg med å gjøre en jevnere overgang med våre forhåndsdefinerte konsulent-, installasjons- og migrasjonspakker for et bredt spekter av Fortinet-produkter.

Om oss

Insoft Tilbyr autoriserte opplærings- og konsulenttjenester for utvalgte IP-leverandører. Finn ut hvordan vi revolusjonerer bransjen.

Les mer
  • +47 23 96 21 03
  • Registrer

    • Network Traffic Analysis with Network Forensics

    Enroll Now
    Duration
    2 Dager
    Delivery
    (Online Og På stedet)
    Price
    Pris på forespørsel

    This course covers the fundamentals and concepts of network traffic analysis—how to search, filter, analyze, reconstruct, and preserve network traffic; and how to apply techniques learned to conduct a network forensics investigation utilizing the Trellix Network Forensics solution.

     

    Hands-on activities include building an analysis dashboard, executing queries, filtering results, and reconstructing network traffic. On Day 2, learners will pursue an alert and identify anomalies in network traffic to uncover and document indicators of compromise (IOCs) that build a case for a real-world advanced threat.

    • Describe networking models, network data, critical application protocols, network flow, and common attacks on protocols
    • Perform network traffic analysis and investigations using Trellix Network Forensics
    • Customize the analysis environment with dashboards, network visualizations, scheduled queries, and lists
    • Reconstruct carved artifacts/files from network packet data and submit them for malware analysis
    • Investigate an advanced persistent threat (APT) attack based on aggregated alerts and network traffic anomalies

    Day 1: Fundamentals

    Appliance Overview and Network Placement

    • Trellix Packet Capture
    • Trellix Investigation Analysis
    • Analysis workflow example
    • The Trellix Packet Capture and Trellix Investigation Analysis relationship
    • Common deployments

    Network Traffic Analysis Foundations

    • Network models and encapsulation: TCP/IP, UDP
    • The three-way handshake
    • Network forensics data
    • Packet captures
    • Flow data
    • Network flow analysis
    • Critical application protocols
    • Protocols in the TCP/IP stack
    • Common attacks on protocols

    Queries, Reconstruction and Alerts with Investigation Analysis

    • Working with dashboards
    • Searching for network data
    • Constructing queries
    • Network metadata analysis
    • Stacking metadata
    • Filtering traffic using network metadata
    • Scheduling queries and reporting
    • Lists
    • Extracting endpoint information
    • Trellix alerts from integrated appliances
    • Configuring event-based capture rule sets
    • Working with rule sets
    • Network data reconstruction

    Day 2: Investigation Workshop

    Network Investigation Scenario

    • Investigation tools
    • Six steps of an attack
    • Common indicators of compromise
    • Threat group overview
    • Trellix Network Forensics investigations
    • Documenting the investigation
    • Threat group intelligence
    • Attack phases covered in class
    • Investigation labs overview

    Starting with Leads

    • Alerts on Trellix Investigation Analysis
    • Alerts on Trellix Network Security
    • Unusual HTTP user agents
    • Unusual POST requests
    • Trellix Investigation Analysis components
    • Other possible leads

    Investigating the Leads

    • Dive deeper
    • HTTP artifacts analysis
    • Encrypted flows
    • Email analysis

    Investigation Summary and Conclusions

    • Investigation summary
    • Stages of the attack
    • Creating a case

    Network security professionals and incident responders who use Trellix Packet Capture and Investigation Analysis appliances to analyze cyber threats through packet data.

    A working understanding of networking and network security, knowledge of Wireshark recommended.

    Overview

    This course covers the fundamentals and concepts of network traffic analysis—how to search, filter, analyze, reconstruct, and preserve network traffic; and how to apply techniques learned to conduct a network forensics investigation utilizing the Trellix Network Forensics solution.

     

    Hands-on activities include building an analysis dashboard, executing queries, filtering results, and reconstructing network traffic. On Day 2, learners will pursue an alert and identify anomalies in network traffic to uncover and document indicators of compromise (IOCs) that build a case for a real-world advanced threat.

    • Describe networking models, network data, critical application protocols, network flow, and common attacks on protocols
    • Perform network traffic analysis and investigations using Trellix Network Forensics
    • Customize the analysis environment with dashboards, network visualizations, scheduled queries, and lists
    • Reconstruct carved artifacts/files from network packet data and submit them for malware analysis
    • Investigate an advanced persistent threat (APT) attack based on aggregated alerts and network traffic anomalies

    Day 1: Fundamentals

    Appliance Overview and Network Placement

    • Trellix Packet Capture
    • Trellix Investigation Analysis
    • Analysis workflow example
    • The Trellix Packet Capture and Trellix Investigation Analysis relationship
    • Common deployments

    Network Traffic Analysis Foundations

    • Network models and encapsulation: TCP/IP, UDP
    • The three-way handshake
    • Network forensics data
    • Packet captures
    • Flow data
    • Network flow analysis
    • Critical application protocols
    • Protocols in the TCP/IP stack
    • Common attacks on protocols

    Queries, Reconstruction and Alerts with Investigation Analysis

    • Working with dashboards
    • Searching for network data
    • Constructing queries
    • Network metadata analysis
    • Stacking metadata
    • Filtering traffic using network metadata
    • Scheduling queries and reporting
    • Lists
    • Extracting endpoint information
    • Trellix alerts from integrated appliances
    • Configuring event-based capture rule sets
    • Working with rule sets
    • Network data reconstruction

    Day 2: Investigation Workshop

    Network Investigation Scenario

    • Investigation tools
    • Six steps of an attack
    • Common indicators of compromise
    • Threat group overview
    • Trellix Network Forensics investigations
    • Documenting the investigation
    • Threat group intelligence
    • Attack phases covered in class
    • Investigation labs overview

    Starting with Leads

    • Alerts on Trellix Investigation Analysis
    • Alerts on Trellix Network Security
    • Unusual HTTP user agents
    • Unusual POST requests
    • Trellix Investigation Analysis components
    • Other possible leads

    Investigating the Leads

    • Dive deeper
    • HTTP artifacts analysis
    • Encrypted flows
    • Email analysis

    Investigation Summary and Conclusions

    • Investigation summary
    • Stages of the attack
    • Creating a case

    Network security professionals and incident responders who use Trellix Packet Capture and Investigation Analysis appliances to analyze cyber threats through packet data.

    A working understanding of networking and network security, knowledge of Wireshark recommended.

      Datoer
      Date on Request

    Follow Up Courses

    Filtrer
    Kategori

    Order A-Z

    Order Z-A

    42 results

    • Drive Encryption for PC Administration
      4 Dager
      Date on Request
      Price on Request
      Book Now

    • Data Loss Prevention Network Administration
      4 Dager
      Date on Request
      Price on Request
      Book Now

    • Alert Analysis and Investigations with Network Security and Endpoint Security (HX)
      4 Dager
      Date on Request
      Price on Request
      Book Now

    • Investigations with Endpoint Security (HX)
      3 Dager
      Date on Request
      Price on Request
      Book Now

    • Investigations with Helix, Network and Endpoint Bundle (Helix, HX, NX)
      4 Dager
      Date on Request
      Price on Request
      Book Now

    • Data Loss Prevention Endpoint Complete Administration
      4 Dager
      Date on Request
      Price on Request
      Book Now

    • EPO – ePolicy Orchestrator Administration
      4 Dager
      Date on Request
      Price on Request
      Book Now

    • Enterprise Security Manager Advanced Topics
      4 Dager
      Date on Request
      Price on Request
      Book Now

    • Threat Hunting Fundamentals
      4 Dager
      Date on Request
      Price on Request
      Book Now

    • Alert Analysis and Diagnostics with Email Security – Server
      2 Dager
      Date on Request
      Price on Request
      Book Now

    Know someone who´d be interested in this course?
    Let them know...

    Use the hashtag #InsoftLearning to talk about this course and find students like you on social media.