CompTIA CySA+

Logs are only useful once they can be searched. You collect and normalize events, write queries, build correlation rules and tune alerts until the team trusts what the SIEM raises.

• Log collection, parsing and time synchronization
• Writing SIEM queries
• Correlation rules and use cases
• Reducing false positives
• Dashboards for operations
• Retention and evidence quality

You build Three tuned detection rules, each with a test case and a note on its false positives.

Packets and processes show what logs hide. You read packet captures and flow records, examine DNS and proxy data, and use endpoint detection tools to follow a process back to its cause.

• Packet capture analysis
• Flow data and traffic baselines
• DNS, proxy and email gateway records
• Endpoint detection and response data
• Process trees and parent-child anomalies
• File integrity and registry changes

You build An investigation write-up that follows one suspicious host through network and endpoint evidence.

Attackers leave patterns. You learn indicators of compromise and of attack, and the behaviors of command-and-control, lateral movement, privilege escalation, persistence and data theft, and how to confirm each.

• Indicators of compromise and of attack
• Beaconing and command-and-control traffic
• Credential abuse and lateral movement
• Persistence mechanisms
• Data exfiltration patterns
• Phishing and malicious file analysis
• Obfuscated scripts and living off the land

You build A catalog of ten attacker behaviors, each with the telemetry that reveals it.

Intelligence turns other people’s incidents into your detections. You assess sources, map behavior to ATT&CK, share indicators in standard formats, and run hunts that start from a hypothesis rather than an alert.

• Intelligence types and source reliability
• MITRE ATT&CK mapping
• Kill chain and diamond models
• STIX, TAXII and sharing communities
• Hypothesis-driven hunting
• Turning a hunt into a permanent detection

You build A hunt plan and results for one hypothesis, ending with a new detection.

Volume demands automation. You script routine checks, use regular expressions and APIs, build orchestration playbooks, and judge where AI-assisted triage helps and where it needs human review.

• Regular expressions for log parsing
• Python and PowerShell for analysts
• Working with security tool APIs
• Orchestration and automated response
• AI-assisted triage and its failure modes
• Deciding what to automate

You build An automated enrichment script and response playbook for phishing reports.

Scanning finds weaknesses before others do, if it is configured well. You compare credentialed, agent and external scans, set scope and schedule, and read scanner output without taking every finding at face value.

• Asset discovery and scope
• Credentialed, agent-based and external scans
• Web application and cloud scanning
• Scanning fragile and industrial systems safely
• Scan scheduling and performance impact
• Validating findings and removing false positives

You build A scan configuration and a validated findings list for one network segment.

Not every flaw deserves the same urgency. You use standard identifiers and scoring, weigh exploitability, exposure and asset value, and choose an order of work you can defend.

• CVE, CWE and vulnerability databases
• CVSS scoring and its limits
• Known exploited vulnerability lists and exploit likelihood
• Asset criticality and exposure
• Compensating controls
• Building a risk-based priority list

You build A prioritized remediation list for forty findings, with the reasoning for the ordering.

Finding a weakness changes nothing until it is fixed. You coordinate patching and configuration changes, track exceptions, verify fixes by rescanning, and reduce the attack surface that creates the findings.

• Patching, configuration and segmentation fixes
• Working with system owners and change control
• Remediation timelines and exceptions
• Verification by rescanning
• Reducing the attack surface
• Secure development testing for analysts

You build A remediation tracker that follows five vulnerabilities from finding to verified fix.

A response goes better when it was planned. You work through preparation, detection and analysis, containment, eradication, recovery and review, and define severity, roles and communication before an incident forces the issue.

• Incident response plans and teams
• Classifying and prioritizing incidents
• Containment strategies and their costs
• Eradication and recovery steps
• Evidence handling and chain of custody
• Playbooks for common incident types

You build An incident response plan with severity levels, roles and three playbooks.

Investigation turns evidence into a timeline and a cause. You examine disks, memory and cloud records, trace an intrusion to its entry point, and confirm that recovery actually removed the attacker.

• Disk and memory evidence basics
• Building an incident timeline
• Finding root cause and entry point
• Ransomware and business email compromise
• Insider threats and cloud incidents
• Confirming eradication and monitoring afterwards

You build An investigation file for a simulated breach, with timeline, root cause and containment record.

Findings matter when decision-makers understand them. You measure operations and vulnerability programs, write reports for technical and executive readers, and communicate with legal, management and affected teams during an incident.

• Meaningful security metrics
• Vulnerability management reports and trends
• Incident and root cause reports
• Executive summaries
• Communicating during a live incident
• Lessons learned and improvement actions

You build An executive summary and a technical report for the same incident.

One scenario uses everything. You triage alerts, hunt, run and prioritize a scan, handle an incident from detection to closure and report on it to technical and executive audiences.

• Triaging a queue of alerts
• Hunting and escalating
• Prioritizing the vulnerabilities found
• Running the response to a confirmed incident
• Reporting to two audiences

You build A shift log, incident report and vulnerability brief from one simulated environment.