Security Event Triage: Monitoring Network Application Services

Exploited network application services allow a malicious actor to establish covert channels and silently exfiltrate data. This course will show you how to use the service logs to quickly detect these attacks and closedown the open threat vectors.

Network application services are both ubiquitous and exploitable. If successfully compromised by a sophisticated threat actor they provide the means for establishing C2 channels and exfiltrating company information. In this course, Security Event Triage: Monitoring Network Application Services, you will learn foundational knowledge of the tools and techniques you can apply to detect when and how these essential services have been compromised. First, you will learn the techniques an APT agent can employ in order to exploit the different types of network application services. Next, you will discover what the security events written to the log files can reveal about the attack that’s unfolding. Finally, you will explore how to use freely available tools to analyze events from across the network to differentiate the good from the bad in terms of the malicious use of these services. When you’re finished with this course, you will have the skills and knowledge of monitoring network application services needed to protect your organization from sophisticated cyberattacks seeking to exploit these essential network protocols.