SANS Security Operations
'SANS SECURITY OPERATION' is a practical operational guide dedicated to Security Operations Center (SOC) workflows, SIEM engineering, and defensive threat hunting. Focusing on the methodologies needed to detect, analyze, and remediate enterprise intrusions, this text provides actionable blueprints for cyber defense.
The book explores log ingestion, Splunk search processing language (SPL), alert correlation rule development, incident triage, memory and endpoint analysis, threat intelligence integration, and MITRE ATT&CK alignment. Real-world scenario drills and interview preparation questions prepare readers for operational SOC roles.
A must-read for SOC analysts, SIEM administrators, threat hunters, and IT security engineers working in modern enterprise defense centers.
The book explores log ingestion, Splunk search processing language (SPL), alert correlation rule development, incident triage, memory and endpoint analysis, threat intelligence integration, and MITRE ATT&CK alignment. Real-world scenario drills and interview preparation questions prepare readers for operational SOC roles.
A must-read for SOC analysts, SIEM administrators, threat hunters, and IT security engineers working in modern enterprise defense centers.
Contents at a Glance
Chapter 1: Security Operations Center (SOC) Roles, Architecture, and Tiers
Chapter 2: Log Sources and Telemetry: Network, Endpoint, Cloud, and Identity
Chapter 3: Triaging Security Alerts: True Positives vs. False Positives
Chapter 4: Analyzing Common Incident Types: Phishing, Malware, Brute Force, and C2
Chapter 5: Incident Response Workflows: Containment, Eradication, and Recovery
Chapter 6: Developing Playbooks and Automating Responses (SOAR)
Chapter 7: Building a SOC Home Lab: Virtual Machines, Wazuh, and Zeek
Chapter 8: SOC Analyst Technical Interview Preparation & Scenario Drills
Index & Further Reading
Chapter 1: Security Operations Center (SOC) Roles, Architecture, and Tiers
Chapter 2: Log Sources and Telemetry: Network, Endpoint, Cloud, and Identity
Chapter 3: Triaging Security Alerts: True Positives vs. False Positives
Chapter 4: Analyzing Common Incident Types: Phishing, Malware, Brute Force, and C2
Chapter 5: Incident Response Workflows: Containment, Eradication, and Recovery
Chapter 6: Developing Playbooks and Automating Responses (SOAR)
Chapter 7: Building a SOC Home Lab: Virtual Machines, Wazuh, and Zeek
Chapter 8: SOC Analyst Technical Interview Preparation & Scenario Drills
Index & Further Reading
