FOR572: Advanced Network Forensics: Threat Hunting, Analysis and Incident Response

• 

  Know how to extract files from network packet captures and proxy cache files, allowing follow-on malware analysis or definitive data loss determinations

• 

  Learn how to decrypt captured SSL/TLS traffic to identify attackers' actions and what data they extracted from the victim

• 

  Understand how to incorporate log data into a comprehensive analytic process, filling knowledge gaps that may be far in the past

• 

  Learn how attackers leverage meddler-in-the-middle tools to intercept seemingly secure communications

• 

  Examine proprietary network protocols to determine what actions occurred on the endpoint systems and learn how to modify configuration on typical network devices such as firewalls and intrusion detection systems to increase the intelligence value of their logs and alerts during an investigation