Prevention will never stop every attack, so defenders also need to notice when something gets through and know what to do next. You'll start with the tools and frameworks that make detection possible: the SIEM, which collects and correlates logs from across an organisation, and the MITRE ATT&CK framework, which gives defenders a shared language for attacker tactics and techniques.
Then you'll learn how to turn that knowledge into action. You'll write vendor-neutral Sigma detection rules, go looking for attackers that automated alerts missed through threat hunting, and see how a security operations centre works an alert from first triage through escalation, remediation and incident response.
Once you can detect and respond to attacks, you'll be ready for the next module, Malware Analysis & Forensics, where you examine malicious software and the evidence an attack leaves behind.
What a SIEM is and why it sits at the heart of a security operations centre, plus how newer approaches add user and entity behaviour analytics (UEBA) and automated response (SOAR).
A workshop led by a MITRE cyber operations lead: the parts of ATT&CK, how it gives defenders a common language for tactics, techniques and procedures, and common use cases and tools. A long session, so set aside time.
What threat hunting is and why proactive hunting beats waiting for alerts, how hunters build and test a hypothesis, and the difference between IOC sweeps and hypothesis-driven hunts.
Follow an incident from the moment an alert fires: L1 triage and false positives, escalation to L2 and L3, major incidents, and how threat intelligence, hunting and DFIR fit together.