Learning path
Coming Soon
Threat Detection and Incident Response: Precision in Practice
Skill Level
Intermediate
Duration 4 hours 20 minutes
Updated Apr 29, 2025
About this learning path
This intermediate learning path builds on the fundamentals by equipping SOC analysts with the skills to investigate early-stage attacks using XDR, correlate endpoint and network telemetry, and respond with precision. Through hands-on labs featuring CrowdStrike Falcon, Security Onion, and SOAR automation, learners will detect fileless malware, analyze identity-based threats, contain credential abuse, and fine-tune noisy detections — all while thinking and acting like a Tier 2 analyst in a real-world SOC environment.
Your instructors
Kendall AhernWorld Wide TechnologySolutions Development Intern
Shoaib Mohammed ShahapuriWorld Wide TechnologyTechnical Solutions Architect
Prerequisites
- ✅ Completed the Threat Detection and Incident Response Essentials learning path, or possess equivalent foundational knowledge
- ✅ Basic understanding of endpoint security concepts, including malware execution, PowerShell abuse, and phishing techniques
- ✅ Familiarity with CrowdStrike Falcon XDR interface and core detection workflows
- ✅ Awareness of MITRE ATT&CK tactics and techniques (e.g., Initial Access, Credential Access, Lateral Movement)
- ✅ Comfort navigating Windows and Linux operating systems, especially command-line usage
- ✅ Introductory experience with network security concepts, such as DNS, HTTP, and lateral movement visibility
- ✅ Optional: Basic exposure to Security Onion or Suricata/Zeek logs will be helpful for correlating alerts
What you'll learn
- 🧠 Validate behavioral detections in CrowdStrike Falcon XDR and distinguish real threats from false positives
- 🔍 Investigate early-stage attacks involving encoded PowerShell, fileless malware, and LOLBins
- 🧑💻 Analyze process lineage and command-line arguments to uncover attacker techniques and objectives
- 🔐 Detect credential theft and identity-based abuse, including Mimikatz, Kerberoasting, and Pass-the-Hash
- 🌐 Correlate endpoint and network telemetry, using Zeek and Suricata logs from Security Onion
- ⚙️ Automate incident response actions using Falcon SOAR, including containment and credential resets
- 📈 Fine-tune detection rules (Sigma, YARA, Suricata) to reduce alert noise and improve SOC efficiency
- 🧾 Document incident response workflows and contribute to SOC-wide IR playbooks and continuous improvement