ISACA Certified Cybersecurity Operations Analyst

Evidence lives in the operating system. You study processes, services, users and the registry on Windows, the equivalent on Linux, and the logs each produces, so you know where to look when something is wrong.

• Windows processes, services and the registry
• Windows event logs and what they record
• Active Directory and authentication basics
• Linux processes, permissions and logs
• The command line for investigation
• Persistence locations on each system

You build A reference of ten high-value log sources on Windows and Linux, with what each reveals.

Attacks reach through applications and cloud accounts. You learn how web applications, APIs and databases fit together, how cloud services are organized, and what logging cloud and container platforms provide.

• Web applications, APIs and databases
• Cloud service models and shared responsibility
• Cloud identities, logs and common misconfigurations
• Virtualization and containers
• Email and collaboration platforms
• Where applications leave evidence

You build A map of one organization’s applications and cloud services, with the log sources each provides.

Controls explain what an analyst expects to see and what failure looks like. You work through confidentiality, integrity and availability, defense in depth, identity, cryptography and the common control frameworks.

• Confidentiality, integrity and availability
• Defense in depth and least privilege
• Identity, authentication and access control
• Cryptography in outline
• Control types and common frameworks
• Policies and procedures an analyst works under

You build A control summary for one environment, showing which controls should have stopped a sample attack.

Analysts rank what they see by consequence. You identify vulnerabilities and their scoring, run a simple scan with open-source tools and weigh a finding against the business it affects.

• Risk, threat, vulnerability and impact
• Vulnerability identifiers and scoring
• Scanning with open-source tools
• Reading and validating scan results
• Business context for risk decisions
• Reporting a vulnerability clearly

You build A scanned lab network with a validated and prioritized vulnerability list.

Attackers follow patterns that can be named. You study the tactics, techniques and procedures catalogued in ATT&CK, the stages of an intrusion and the tools attackers favor at each stage.

• The ATT&CK matrix and how to read it
• Reconnaissance and initial access
• Execution, persistence and privilege escalation
• Credential access and lateral movement
• Command and control, exfiltration and impact
• Ransomware and its typical timeline

You build An attack chain map for a sample intrusion, with each step matched to a technique.

Each technique leaves a trace. You learn the log entries, process behaviors and network patterns that point to phishing, web attacks, credential theft, lateral movement and malware, and you practice finding them.

• Phishing and malicious attachment evidence
• Web attack evidence in server logs
• Credential attack and misuse patterns
• Lateral movement traces
• Suspicious process and script behavior
• Command and control beaconing in traffic
• False positives that resemble attacks

You build A detection notebook that pairs ten techniques with the evidence that reveals them.

Detection starts with collecting the right logs. You build a small open-source logging and detection stack, write and test detection rules in a shared format, and tune alerts until they are worth reading.

• Log collection, parsing and storage
• An open-source SIEM stack in a lab
• Writing detection rules in Sigma
• Queries and visualizations
• Tuning alerts and removing noise
• Testing detections against simulated attacks

You build A working lab SIEM with five tested detection rules.

Alerts need confirming with deeper tools. You analyze traffic with intrusion detection and network metadata tools, inspect hosts with endpoint query tools, and examine files and memory for malicious content.

• Network metadata with Zeek
• Signature detection with Suricata
• Host queries with osquery
• Matching malware with YARA rules
• Basic memory analysis with Volatility
• Tying network and host evidence together

You build A tool-by-question guide, plus an investigation that confirms an alert using three tools.

A good analyst follows a method under pressure. You triage alerts, scope and contain an incident, collect evidence properly, eradicate and recover, and document each step as you go.

• Alert triage and prioritization
• Scoping an incident
• Containment and eradication
• Evidence collection and handling
• Recovery and verification
• Incident documentation and handoffs

You build An incident record for a simulated intrusion, with timeline, actions and evidence log.

Indicators from outside help you look inside. You enrich alerts with open intelligence, share indicators in standard formats and run simple hunts that start from a hypothesis.

• Indicators of compromise and their shelf life
• Enriching alerts with open intelligence
• Sharing indicators with a threat platform
• Forming and testing a hunting hypothesis
• Turning hunt results into detections
• Intelligence quality and bias

You build A hunt report for one hypothesis, ending with a new detection rule.

Securing assets reduces what analysts have to chase. You apply hardening benchmarks, manage patches and configuration baselines, harden endpoints and cloud accounts and check that settings hold.

• Hardening benchmarks and baselines
• Patch and configuration management
• Endpoint hardening on Windows and Linux
• Cloud account and storage hardening
• Asset inventory as a security control
• Verifying configuration with open-source tools

You build A hardened lab host and cloud account, with a scan that shows the improvement.

Controls around people, data and traffic limit damage. You apply access control, multi-factor sign-in, encryption, backup and network defenses, and judge where each stops or only slows an attack.

• Identity and privileged access protection
• Multi-factor authentication and its bypasses
• Encryption and backup protection
• Firewall and segmentation rules
• Email and web filtering
• Data loss prevention basics

You build A control review for one attack path, showing where each control would stop or detect it.

One scenario runs the full analyst workflow. You receive an alert, confirm it with open-source tools, scope the intrusion, contain it, harden the weakness and write the report.

• Receiving and triaging the alert
• Confirming and scoping with tools
• Containing and eradicating
• Hardening the weakness exploited
• Writing the report

You build A completed investigation file: evidence, timeline, containment actions and final report.