CyberDefenders certifications mapped to the Canadian Cyber Security Skills Framework
CCDL1 and CCDL2 map to three defensive roles in the Canadian framework: cyber security operations analyst, cyber incident responder, and digital forensics analyst. CCDL2 has primary alignment to the operations analyst and digital forensics analyst roles.
Last reviewed: October 2026
What is the Canadian Cyber Security Skills Framework?
It is the Canadian Centre for Cyber Security's reference for cybersecurity work roles in Canada. Each role profile lists its tasks and the competencies the work requires.
Employers, schools, and training providers use it to plan hiring, careers, and training. This mapping uses ITSM.00.039, the 2023 v2 edition.
Source: Canadian Centre for Cyber Security, Canadian Cyber Security Skills Framework
Which Canadian framework roles does CCDL1 align to?
CCDL1 has strong relevant alignment to all three defensive roles: cyber security operations analyst, cyber incident responder, and digital forensics analyst.
Learners triage and correlate alerts, write and test IDS rules, contain endpoints, collect and analyze forensic evidence, and build incident timelines. It is an entry-level certification, so it covers a meaningful part of each role rather than the full profile.
Which Canadian framework roles does CCDL2 align to?
CCDL2 has primary alignment to cyber security operations analyst and digital forensics analyst, and strong relevant alignment to cyber incident responder.
Learners investigate with Elastic SIEM and KQL, build detections, hunt threats, acquire and analyze disk, memory, and network evidence, and run incident response from triage to recovery and reporting.
Which SOC tiers do CCDL1 and CCDL2 align to?
The framework splits the operations analyst role into three SOC tiers. CCDL2 has primary alignment to Tier 1 and Tier 2. CCDL1 has strong relevant alignment to Tiers 1 and 2.
| SOC tier | CCDL1 | CCDL2 |
|---|---|---|
| Tier 1 | Strong relevant alignment | Primary alignment |
| Tier 2 | Strong relevant alignment | Primary alignment |
| Tier 3 | Strong relevant alignment | Strong relevant alignment |
Tier 3 covers active defence work, such as legal authority and countermeasures, which goes beyond the scope of both courses.
How did we map CCDL1 and CCDL2 to the Canadian framework?
We scored every task and competency in each selected role profile against the live, published lessons and labs of each course.
Each item is marked Covered, Partially covered, or Not evidenced, with the lesson or lab that supports it. Primary alignment requires broad coverage of the profile and full coverage of the tasks that define the role. We screened other roles, such as security architect and privacy officer, and did not score them because their focus is governance or architecture. The mapping was captured in October 2026 and is reviewed yearly.
How can teams in Canada use this mapping?
- Match SOC, incident response, and forensics hires to Canadian framework roles.
- Plan training by SOC tier, from Tier 1 to Tier 2.
- Show HR which framework roles your training covers.
Building a SOC team? See our cybersecurity training for teams and enterprises.
Which framework tasks do the courses cover?
A sample of Canadian framework tasks the courses fully cover, with where they are taught.
| Role | Framework task | Course | Where it is taught |
|---|---|---|---|
| Cyber security operations analyst | Identify and analyze technical threats to, and vulnerabilities of, networks | CCDL1 | Module 2: Network & Endpoint Security: Section 2: Spotting the Reconnaissance: Detecting the Port Scan |
| Cyber incident responder | Perform real-time cyber defense incident handling tasks (e.g. forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) | CCDL1 | Module 4: Digital Forensics: Section 3: Memory Acquisition and Verification |
| Digital forensics analyst | Perform real-time cyber defence incident investigations (e.g. forensic collections, intrusion correlation and tracking, and threat analysis) | CCDL1 | Module 4: Digital Forensics: Section 3: Memory Acquisition and Verification |
| Cyber security operations analyst | Identify and analyze technical threats to, and vulnerabilities of, networks | CCDL2 | Security Operations Fundamentals: Understanding Vulnerability Management Process. |
| Cyber incident responder | Perform real-time cyber defense incident handling tasks (e.g. forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) | CCDL2 | Incident Response: [Walkthrough] Capturing a Memory Dump for an Infected Process using Velociraptor |
| Digital forensics analyst | Perform real-time cyber defence incident investigations (e.g. forensic collections, intrusion correlation and tracking, and threat analysis) | CCDL2 | Incident Response: [Walkthrough] Capturing a Memory Dump for an Infected Process using Velociraptor |
View the full CCDL1 and CCDL2 Canadian framework mapping
Every task and competency in the three main defensive roles. Requirements with no evidence in the live course are not listed.
CCDL1: 98 requirements covered or partially covered
| Role | Framework requirement | Type | Coverage | Where it is taught |
|---|---|---|---|---|
| Cyber security operations analyst | Network security administration and management | Knowledge or skill | Partial | Module 2: Network & Endpoint Security: Section 9: Firewall Logging and Blocked Traffic |
| Cyber security operations analyst | Network security architecture | Knowledge or skill | Covered | Module 2: Network & Endpoint Security: Section 2: How an IDS Watches the Network |
| Cyber security operations analyst | Software defined security and application security | Knowledge or skill | Partial | Module 2: Network & Endpoint Security: Section 5: Gaining Command Execution: The Web Shell |
| Cyber security operations analyst | Cloud-based security | Knowledge or skill | Covered | Module 5: Cloud Threat Detection: Section 3: Service Models and Shared Responsibility |
| Cyber security operations analyst | IT security zoning | Knowledge or skill | Covered | Module 6: Incident Handling Process: Section 4: Mapping the Incident: How the Pieces Fit |
| Cyber security operations analyst | Encryption and cryptography including key management concepts and principles | Knowledge or skill | Partial | Module 4: Digital Forensics: Section 2: Checking for Disk Encryption Before Acquisition |
| Cyber security operations analyst | Web application security | Knowledge or skill | Partial | Module 2: Network & Endpoint Security: Section 4: From Recon to Foothold: Enumeration |
| Cyber security operations analyst | Legal and ethical responsibilities associated with cyber security operations including conduct of investigations, privacy, and preservation of evidence | Knowledge or skill | Partial | Module 4: Digital Forensics: Section 2: What Is Digital Forensics |
| Cyber security operations analyst | Writing and briefing on technical matters (e.g. incident reports, technical reports, etc.) for managerial level understanding | Knowledge or skill | Covered | Module 6: Incident Handling Process: Section 5: Documentation and Communication: Handing It Off Cleanly |
| Cyber security operations analyst | Network security appliance concepts, operation and configuration (equipment specific based on role - network, server and desktop cyber defence systems and/or appliances) | Knowledge or skill | Covered | Module 2: Network & Endpoint Security: Section 4: Running a Rule and Reading the Alert |
| Cyber security operations analyst | Types of intrusions and indicators of compromise (IoCs) | Knowledge or skill | Covered | Module 2: Network & Endpoint Security: Section 9: Compiling the Findings and Escalating |
| Cyber security operations analyst | Sources of threat information | Knowledge or skill | Covered | Module 6: Incident Handling Process: Section 5: Threat Intelligence and Hunting: Widening the View |
| Cyber security operations analyst | Common threat actor tactics, techniques, and procedures (TTPs) | Knowledge or skill | Covered | Module 3: SIEM & Log Analysis: Section 3: MITRE ATT&CK & the Hunting Methodology |
| Cyber security operations analyst | Incident management processes, responsibilities and authorities | Knowledge or skill | Covered | Module 6: Incident Handling Process: Section 2: Triage: Ranking a Queue When Money Is on the Line |
| Cyber security operations analyst | Intrusion detection and prevention methodologies, tools and systems | Knowledge or skill | Covered | Module 2: Network & Endpoint Security: Section 2: How an IDS Watches the Network |
| Cyber security operations analyst | Intrusion analysis and mitigation techniques | Knowledge or skill | Covered | Module 2: Network & Endpoint Security: Section 7: Hunting for the Attack Across the Environment |
| Cyber security operations analyst | Basic malware analysis | Knowledge or skill | Covered | Module 1: Phishing Analysis: Section 4: Oletools and Malicious Macros Analysis |
| Cyber security operations analyst | Persistent and sophisticated threat TTPs | Knowledge or skill | Partial | Module 3: SIEM & Log Analysis: Section 4: APT Detection and Correlation Engine Analysis |
| Cyber security operations analyst | Cyber defence tools, techniques and procedures | Knowledge or skill | Covered | Module 2: Network & Endpoint Security: Section 5: Writing Your First Rule |
| Cyber security operations analyst | Development and testing of network security appliances (including scripts and coding). | Knowledge or skill | Partial | Module 2: Network & Endpoint Security: Section 5: Writing Your First Rule |
| Cyber security operations analyst | Advanced malware analysis and reverse malware engineering. | Knowledge or skill | Partial | Module 1: Phishing Analysis: Section 9: VBA Stomping |
| Cyber security operations analyst | Implementing advance security controls in response to advanced persistent threats | Knowledge or skill | Partial | Module 2: Network & Endpoint Security: Section 9: Taking Response Actions |
| Cyber security operations analyst | Advanced incident response and recovery activities | Knowledge or skill | Partial | Module 6: Incident Handling Process: Section 6: Escalation and Containment: Acting Without Making It Worse |
| Cyber security operations analyst | Advanced threat management | Knowledge or skill | Partial | Module 6: Incident Handling Process: Section 2: Triage: Ranking a Queue When Money Is on the Line |
| Cyber security operations analyst | Advanced threat actor TTPs including specialization of persistent threat actors (e.g. nation state, organized crime) | Knowledge or skill | Partial | Module 3: SIEM & Log Analysis: Section 4: APT Detection and Correlation Engine Analysis |
| Cyber security operations analyst | Exploitation analysis | Knowledge or skill | Partial | Module 2: Network & Endpoint Security: Section 5: Gaining Command Execution: The Web Shell |
| Cyber security operations analyst | Threat hunting and active defence frameworks | Knowledge or skill | Partial | Module 3: SIEM & Log Analysis: Section 2: What Is Threat Hunting? |
| Cyber security operations analyst | Developing complex courses of action including risk assessment and mitigation plan | Knowledge or skill | Partial | Module 6: Incident Handling Process: Section 2: Triage: Ranking a Queue When Money Is on the Line |
| Cyber security operations analyst | Adversarial thinking | Knowledge or skill | Covered | Module 3: SIEM & Log Analysis: Section 3: MITRE ATT&CK & the Hunting Methodology |
| Cyber security operations analyst | Identify and analyze technical threats to, and vulnerabilities of, networks | Task | Covered | Module 2: Network & Endpoint Security: Section 2: Spotting the Reconnaissance: Detecting the Port Scan |
| Cyber security operations analyst | Identify, contain, conduct initial mitigations and report system compromises | Task | Covered | Module 2: Network & Endpoint Security: Section 9: Taking Response Actions |
| Cyber security operations analyst | Review, analyze, and/or apply Internet security protocols, cryptographic algorithms, directory standards, networking protocols, network hardening, technical IT security controls, IT security tools and techniques, OS, intrusion detection/protection systems, firewalls, routers, multiplexers and switches, and wireless devices | Task | Partial | Module 2: Network & Endpoint Security: Section 2: Mapping Normal Network Communication: Protocols and Their Ports |
| Cyber security operations analyst | Analyze security data and provide alerts, advisories and reports | Task | Covered | Module 3: SIEM & Log Analysis: Section 1: Reading the Alert |
| Cyber security operations analyst | Install, configure, integrate, adjust, operate, monitor performance, and detect faults on security devices and systems | Task | Partial | Module 2: Network & Endpoint Security: Section 4: Running a Rule and Reading the Alert |
| Cyber security operations analyst | Troubleshoot security products and incidents | Task | Covered | Module 2: Network & Endpoint Security: Section 6: Tuning Your Rules |
| Cyber security operations analyst | Complete tasks related to authorization and authentication in physical and logical environments | Task | Partial | Module 5: Cloud Threat Detection: Section 7: Who Can Do What: RBAC |
| Cyber security operations analyst | Implement and test configuration specifications | Task | Covered | Module 2: Network & Endpoint Security: Section 5: Writing Your First Rule |
| Cyber security operations analyst | Review, develop and deliver relevant training material | Task | Partial | Module 1: Phishing Analysis: Section 3: User Training and Phishing Simulation Introduction |
| Cyber incident responder | Network security administration and management | Knowledge or skill | Partial | Module 2: Network & Endpoint Security: Section 9: Firewall Logging and Blocked Traffic |
| Cyber incident responder | Network security architecture | Knowledge or skill | Covered | Module 2: Network & Endpoint Security: Section 2: How an IDS Watches the Network |
| Cyber incident responder | Software defined security and application security | Knowledge or skill | Partial | Module 2: Network & Endpoint Security: Section 5: Gaining Command Execution: The Web Shell |
| Cyber incident responder | Cloud-based security | Knowledge or skill | Covered | Module 5: Cloud Threat Detection: Section 3: Service Models and Shared Responsibility |
| Cyber incident responder | IT security zoning | Knowledge or skill | Covered | Module 6: Incident Handling Process: Section 4: Mapping the Incident: How the Pieces Fit |
| Cyber incident responder | Encryption and cryptography including key management concepts and principles | Knowledge or skill | Partial | Module 4: Digital Forensics: Section 2: Checking for Disk Encryption Before Acquisition |
| Cyber incident responder | Web application security | Knowledge or skill | Partial | Module 2: Network & Endpoint Security: Section 4: From Recon to Foothold: Enumeration |
| Cyber incident responder | Legal and ethical responsibilities associated with cyber security operations including conduct of investigations, privacy, and preservation of evidence | Knowledge or skill | Partial | Module 4: Digital Forensics: Section 2: What Is Digital Forensics |
| Cyber incident responder | Writing and briefing on technical matters (e.g. incident reports, technical reports, etc.) for managerial level understanding | Knowledge or skill | Covered | Module 6: Incident Handling Process: Section 5: Documentation and Communication: Handing It Off Cleanly |
| Cyber incident responder | Business continuity and disaster response basics | Knowledge or skill | Partial | Module 6: Incident Handling Process: Section 4: Escalation and Containment: Acting Without Making It Worse |
| Cyber incident responder | Network security appliance concepts, operation and configuration (equipment specific based on role - network, server and desktop cyber defence systems and/or appliances) | Knowledge or skill | Covered | Module 2: Network & Endpoint Security: Section 4: Running a Rule and Reading the Alert |
| Cyber incident responder | Types of intrusions and indicators of compromise (IoCs) | Knowledge or skill | Covered | Module 2: Network & Endpoint Security: Section 9: Compiling the Findings and Escalating |
| Cyber incident responder | Sources of threat information | Knowledge or skill | Covered | Module 6: Incident Handling Process: Section 5: Threat Intelligence and Hunting: Widening the View |
| Cyber incident responder | Common threat actor tactics, techniques, and procedures (TTPs) | Knowledge or skill | Covered | Module 3: SIEM & Log Analysis: Section 3: MITRE ATT&CK & the Hunting Methodology |
| Cyber incident responder | Incident management processes, responsibilities and authorities | Knowledge or skill | Covered | Module 6: Incident Handling Process: Section 2: Triage: Ranking a Queue When Money Is on the Line |
| Cyber incident responder | Intrusion detection and prevention methodologies, tools and systems | Knowledge or skill | Covered | Module 2: Network & Endpoint Security: Section 2: How an IDS Watches the Network |
| Cyber incident responder | Intrusion analysis and mitigation techniques | Knowledge or skill | Covered | Module 2: Network & Endpoint Security: Section 7: Hunting for the Attack Across the Environment |
| Cyber incident responder | Basic malware analysis | Knowledge or skill | Covered | Module 1: Phishing Analysis: Section 4: Oletools and Malicious Macros Analysis |
| Cyber incident responder | Cyber security investigations and evidence preservation | Knowledge or skill | Covered | Module 4: Digital Forensics: Section 6: Preserving and Handling Evidence |
| Cyber incident responder | Threat and risk assessment to Internet connected OT (including implications and assessment of IoT devices) | Knowledge or skill | Partial | Module 6: Incident Handling Process: Section 5: Threat Intelligence and Hunting: Widening the View |
| Cyber incident responder | Legal and compliance requirements including organizational responsibilities for workplace and public safety related to OT/ production | Knowledge or skill | Partial | Module 6: Incident Handling Process: Section 6: Escalation and Containment: Acting Without Making It Worse |
| Cyber incident responder | Operating systems, networking, and communications systems concepts | Knowledge or skill | Partial | Module 2: Network & Endpoint Security: Section 2: Mapping Normal Network Communication: Protocols and Their Ports |
| Cyber incident responder | Analysis tools and network protocols | Knowledge or skill | Partial | Module 2: Network & Endpoint Security: Section 2: Mapping Normal Network Communication: Protocols and Their Ports |
| Cyber incident responder | Diagnostic tools and fault identification techniques | Knowledge or skill | Partial | Module 2: Network & Endpoint Security: Section 6: Tuning Your Rules |
| Cyber incident responder | Perform real-time cyber defense incident handling tasks (e.g. forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) | Task | Covered | Module 4: Digital Forensics: Section 3: Memory Acquisition and Verification |
| Cyber incident responder | Conduct security triage to identify and analyze cyber incidents and threats | Task | Covered | Module 6: Incident Handling Process: Section 2: Triage: Ranking a Queue When Money Is on the Line |
| Cyber incident responder | Actively monitor networks and systems for cyber incidents and threats | Task | Covered | Module 3: SIEM & Log Analysis: Section 1: Reading the Alert |
| Cyber incident responder | Conduct risk analysis and security reviews of system logs to identify possible cyber threats | Task | Covered | Module 6: Incident Handling Process: Section 2: Triage: Ranking a Queue When Money Is on the Line |
| Cyber incident responder | Conduct analysis and review, and/or apply network scanners, vulnerability assessment tools, network protocols, Internet security protocols, intrusion detection systems, firewalls, content checkers and endpoint software | Task | Partial | Module 2: Network & Endpoint Security: Section 2: Mapping Normal Network Communication: Protocols and Their Ports |
| Cyber incident responder | Collect and analyze data to identify cyber security flaws and vulnerabilities and make recommendations that enable prompt remediation | Task | Covered | Module 2: Network & Endpoint Security: Section 6: Group Policy and the Risk of Misconfiguration |
| Cyber incident responder | Develop and prepare cyber defence incident analysis and reporting | Task | Covered | Module 6: Incident Handling Process: Section 5: Documentation and Communication: Handing It Off Cleanly |
| Cyber incident responder | Define and maintain tool sets and procedures | Task | Partial | Module 2: Network & Endpoint Security: Section 5: Writing Your First Rule |
| Cyber incident responder | Develop, implement, and evaluate prevention and incident response plans and activities, and adapt to contain, mitigate or eradicate effects of cyber security incident | Task | Partial | Module 6: Incident Handling Process: Section 4: Escalation and Containment: Acting Without Making It Worse |
| Cyber incident responder | Provide incident analysis support on response plans and activities | Task | Covered | Module 4: Digital Forensics: Section 8: Investigation Walkthrough and Escalation |
| Cyber incident responder | Review, develop and deliver relevant training material | Task | Partial | Module 1: Phishing Analysis: Section 3: User Training and Phishing Simulation Introduction |
| Digital forensics analyst | Threat actor tools, techniques and procedures | Knowledge or skill | Covered | Module 3: SIEM & Log Analysis: Section 10: Conclusion |
| Digital forensics analyst | Incident response and handling methodologies | Knowledge or skill | Partial | Module 6: Incident Handling Process: Section 4: Escalation and Containment: Acting Without Making It Worse |
| Digital forensics analyst | Security Event and Incident Management System | Knowledge or skill | Covered | Module 3: SIEM & Log Analysis: Section 4: APT Detection and Correlation Engine Analysis |
| Digital forensics analyst | Digital forensics methodologies, processes and practices | Knowledge or skill | Covered | Module 4: Digital Forensics: Section 3: Evidence, Disciplines, and the Investigation Process |
| Digital forensics analyst | Anti-forensics tactics, techniques, and procedure | Knowledge or skill | Partial | Module 4: Digital Forensics: Section 7: Detecting a Falsified Timestamp |
| Digital forensics analyst | Processes for collecting, packaging, transporting, and storing electronic evidence to avoid alteration, loss, physical damage, or destruction of data | Knowledge or skill | Partial | Module 4: Digital Forensics: Section 6: Preserving and Handling Evidence |
| Digital forensics analyst | Seizing and preserving digital evidence | Knowledge or skill | Partial | Module 4: Digital Forensics: Section 3: Memory Acquisition and Verification |
| Digital forensics analyst | Applicable laws, regulations, policies and ethics as they relate to investigations and governance | Knowledge or skill | Partial | Module 4: Digital Forensics: Section 2: What Is Digital Forensics |
| Digital forensics analyst | System or device specific forensics (e.g. memory, active director, mobile device, network, computer [dead box], etc.) | Knowledge or skill | Covered | Module 4: Digital Forensics: Section 4: Volatility and Reading Plugin Output |
| Digital forensics analyst | Malware analysis tools and techniques | Knowledge or skill | Partial | Module 1: Phishing Analysis: Section 4: Oletools and Malicious Macros Analysis |
| Digital forensics analyst | Reverse engineering | Knowledge or skill | Partial | Module 1: Phishing Analysis: Section 9: VBA Stomping |
| Digital forensics analyst | Deployable digital forensics capabilities | Knowledge or skill | Covered | Module 4: Digital Forensics: Section 3: Memory Acquisition and Verification |
| Digital forensics analyst | Types of digital forensics including tools, techniques and procedures (organization and information system dependent) which may include the following forensics for: computer network and Active Directory mobile devices digital media (image, video, audio) memory | Knowledge or skill | Covered | Module 4: Digital Forensics: Section 10: Conclusion |
| Digital forensics analyst | Perform real-time cyber defence incident investigations (e.g. forensic collections, intrusion correlation and tracking, and threat analysis) | Task | Covered | Module 4: Digital Forensics: Section 3: Memory Acquisition and Verification |
| Digital forensics analyst | Investigate security incidents as per terms of reference | Task | Partial | Module 4: Digital Forensics: Section 3: Evidence, Disciplines, and the Investigation Process |
| Digital forensics analyst | Plan forensics analysis activities for cyber incidents | Task | Covered | Module 4: Digital Forensics: Section 3: Evidence, Disciplines, and the Investigation Process |
| Digital forensics analyst | Collect and analyze intrusion artifacts (e.g. source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber defense incidents | Task | Covered | Module 2: Network & Endpoint Security: Section 6: Extracting and Decoding the Payload |
| Digital forensics analyst | Identify and accurately report on digital forensic analysis artifacts | Task | Covered | Module 4: Digital Forensics: Section 7: Correlation, Confidence, and Escalation |
| Digital forensics analyst | Capture and analyze network traffic associated with malicious activities using network monitoring tools | Task | Covered | Module 2: Network & Endpoint Security: Section 5: Capturing and Categorizing Live Traffic |
| Digital forensics analyst | Contribute to post-analysis on security incidents and make recommendations based on forensics activities | Task | Covered | Module 4: Digital Forensics: Section 8: Investigation Walkthrough and Escalation |
| Digital forensics analyst | Develop and maintain investigative and technical reports | Task | Partial | Module 4: Digital Forensics: Section 8: Investigation Walkthrough and Escalation |
| Digital forensics analyst | Provide technical assistance on digital evidence matters to appropriate personnel | Task | Partial | Module 4: Digital Forensics: Section 8: Investigation Walkthrough and Escalation |
| Digital forensics analyst | Manage digital evidence in accordance with appropriate chain of custody requirements | Task | Partial | Module 4: Digital Forensics: Section 2: What Is Digital Forensics |
| Digital forensics analyst | Identify and manage secure analysis infrastructure/laboratory | Task | Partial | Module 4: Digital Forensics: Section 4: Volatility and Reading Plugin Output |
| Digital forensics analyst | Operate digital forensics systems (as required based on function and systems available) | Task | Covered | Module 4: Digital Forensics: Section 7: Disk Imaging and Hash Verification |
CCDL2: 115 requirements covered or partially covered
| Role | Framework requirement | Type | Coverage | Where it is taught |
|---|---|---|---|---|
| Cyber security operations analyst | Network security administration and management | Knowledge or skill | Covered | Network Forensics: Traffic Capture from Switches & Routers |
| Cyber security operations analyst | Network security architecture | Knowledge or skill | Covered | Incident Response: Architecting an IR-Friendly Network |
| Cyber security operations analyst | Software defined security and application security | Knowledge or skill | Partial | Security Operations Fundamentals: Web Application Firewalls (WAFs): Protecting Web Apps |
| Cyber security operations analyst | Virtualization and Virtual Private Network (VPN) security | Knowledge or skill | Partial | Malware Analysis: Monitoring Malware's Network Activity |
| Cyber security operations analyst | Cloud-based security | Knowledge or skill | Covered | Active Directory Attack and Defense: Pass-the-PRT: Detection and Response |
| Cyber security operations analyst | IT security zoning | Knowledge or skill | Covered | Incident Response: Architecting an IR-Friendly Network |
| Cyber security operations analyst | Encryption and cryptography including key management concepts and principles | Knowledge or skill | Partial | Active Directory Attack and Defense: Silver SAML: Attack Mechanics and Walkthrough |
| Cyber security operations analyst | Vulnerability scanning and analysis | Knowledge or skill | Covered | Security Operations Fundamentals: [Walkthrough] Nessus: Perform an Authenticated Advanced Scan |
| Cyber security operations analyst | Vulnerability management tools, processes and procedures | Knowledge or skill | Covered | Security Operations Fundamentals: Understanding Vulnerability Management Process. |
| Cyber security operations analyst | Web application security | Knowledge or skill | Covered | Security Operations Fundamentals: Web Application Firewalls (WAFs): Protecting Web Apps |
| Cyber security operations analyst | Configuration and operational build books | Knowledge or skill | Partial | Incident Response: IR Procedure |
| Cyber security operations analyst | Legal and ethical responsibilities associated with cyber security operations including conduct of investigations, privacy, and preservation of evidence | Knowledge or skill | Partial | Forensics Evidence Collection: Acquisition |
| Cyber security operations analyst | Writing and briefing on technical matters (e.g. incident reports, technical reports, etc.) for managerial level understanding | Knowledge or skill | Covered | Incident Response: Incident Report |
| Cyber security operations analyst | Network security appliance concepts, operation and configuration (equipment specific based on role - network, server and desktop cyber defence systems and/or appliances) | Knowledge or skill | Covered | Incident Response: [Walkthrough] Suricata |
| Cyber security operations analyst | Types of intrusions and indicators of compromise (IoCs) | Knowledge or skill | Covered | Network Forensics: Analyzing Extracted Objects from Network Traffic |
| Cyber security operations analyst | Sources of threat information | Knowledge or skill | Covered | Security Operations Fundamentals: Threat Intelligence: Mitigating and Defending |
| Cyber security operations analyst | Common threat actor tactics, techniques, and procedures (TTPs) | Knowledge or skill | Covered | Threat Hunting: MITRE ATT&CK: Mapping a Full Attack Scenario |
| Cyber security operations analyst | Incident management processes, responsibilities and authorities | Knowledge or skill | Covered | Incident Response: IR Policy |
| Cyber security operations analyst | Intrusion detection and prevention methodologies, tools and systems | Knowledge or skill | Covered | Incident Response: [Walkthrough] Writing Custom Suricata Signatures |
| Cyber security operations analyst | Intrusion analysis and mitigation techniques | Knowledge or skill | Covered | Incident Response: Root Cause Analysis (RCA) |
| Cyber security operations analyst | Basic malware analysis | Knowledge or skill | Covered | Malware Analysis: Intro to Malware Analysis |
| Cyber security operations analyst | Persistent and sophisticated threat TTPs | Knowledge or skill | Covered | Threat Hunting: Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Cyber security operations analyst | Cyber defence tools, techniques and procedures | Knowledge or skill | Covered | Incident Response: [Walkthrough] Writing Custom Suricata Signatures |
| Cyber security operations analyst | Development and testing of network security appliances (including scripts and coding). | Knowledge or skill | Partial | Incident Response: [Walkthrough] Writing Custom Suricata Signatures |
| Cyber security operations analyst | Advanced malware analysis and reverse malware engineering. | Knowledge or skill | Partial | Malware Analysis: Debugging VBA Macros Step-by-Step |
| Cyber security operations analyst | Implementing advance security controls in response to advanced persistent threats | Knowledge or skill | Covered | Active Directory Attack and Defense: Golden Ticket: Detection, Investigation, and Preventions |
| Cyber security operations analyst | Advanced incident response and recovery activities | Knowledge or skill | Partial | Incident Response: Restore, Validate, and Monitor |
| Cyber security operations analyst | Advanced threat management | Knowledge or skill | Partial | Threat Hunting: The Threat Hunting Process |
| Cyber security operations analyst | Advanced threat actor TTPs including specialization of persistent threat actors (e.g. nation state, organized crime) | Knowledge or skill | Covered | Threat Hunting: Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Cyber security operations analyst | Interpreting/synthesizing classified/sensitive threat intelligence from multiple sources | Knowledge or skill | Partial | Threat Hunting: Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Cyber security operations analyst | Exploitation analysis | Knowledge or skill | Covered | Network Forensics: Analyzing HTTP for Reconnaissance and Initial Access |
| Cyber security operations analyst | Threat hunting and active defence frameworks | Knowledge or skill | Partial | Threat Hunting: The Threat Hunting Process |
| Cyber security operations analyst | Developing complex courses of action including risk assessment and mitigation plan | Knowledge or skill | Partial | Incident Response: Incident Prioritization |
| Cyber security operations analyst | Active defence tactics, tools and procedures including advanced threat countermeasures and counter- countermeasures | Knowledge or skill | Partial | Security Operations Fundamentals: Using Honeypots & Decoys for Defense |
| Cyber security operations analyst | Adversarial thinking | Knowledge or skill | Covered | Threat Hunting: How to Approach an Investigation: The Threat Hunter's Mindset |
| Cyber security operations analyst | Developing, testing and deploying technical tools within an active defence framework to protect organizational information and systems at risk | Knowledge or skill | Partial | Incident Response: [Walkthrough] Writing Custom Suricata Signatures |
| Cyber security operations analyst | Identify and analyze technical threats to, and vulnerabilities of, networks | Task | Covered | Security Operations Fundamentals: Understanding Vulnerability Management Process. |
| Cyber security operations analyst | Identify, contain, conduct initial mitigations and report system compromises | Task | Covered | Incident Response: Containment |
| Cyber security operations analyst | Review, analyze, and/or apply Internet security protocols, cryptographic algorithms, directory standards, networking protocols, network hardening, technical IT security controls, IT security tools and techniques, OS, intrusion detection/protection systems, firewalls, routers, multiplexers and switches, and wireless devices | Task | Partial | Network Forensics: PCAP Analysis: Detailed Protocol Analysis |
| Cyber security operations analyst | Analyze security data and provide alerts, advisories and reports | Task | Covered | Incident Response: [Walkthrough] Writing Custom Suricata Signatures |
| Cyber security operations analyst | Install, configure, integrate, adjust, operate, monitor performance, and detect faults on security devices and systems | Task | Partial | Threat Hunting: Fleet: Managing Data Collection at Scale |
| Cyber security operations analyst | Conduct impact analysis for new software implementations, major configuration changes and patch management | Task | Partial | Incident Response: Architecting an IR-Friendly Network |
| Cyber security operations analyst | Develop proof-of-concept models and trials for IT security products and services | Task | Partial | Security Operations Fundamentals: Endpoint Detection and Response (EDR/XDR) |
| Cyber security operations analyst | Troubleshoot security products and incidents | Task | Covered | Incident Response: Root Cause Analysis (RCA) |
| Cyber security operations analyst | Complete tasks related to authorization and authentication in physical and logical environments | Task | Partial | Active Directory Attack and Defense: Securing Forest Trusts Against Cross-Forest ExtraSIDs |
| Cyber security operations analyst | Develop options and solutions to meet the security-related project objectives | Task | Partial | Incident Response: Architecting an IR-Friendly Network |
| Cyber security operations analyst | Identify the security products and its configuration to meet security-related project objectives | Task | Partial | Security Operations Fundamentals: Endpoint Detection and Response (EDR/XDR) |
| Cyber security operations analyst | Implement and test configuration specifications | Task | Covered | Incident Response: [Walkthrough] Writing Custom Suricata Signatures |
| Cyber security operations analyst | Develop configuration and operational build books | Task | Partial | Incident Response: IR Procedure |
| Cyber security operations analyst | Review, develop and deliver relevant training material | Task | Partial | Security Operations Fundamentals: Creating Effective Cybersecurity Training Plans |
| Cyber incident responder | Network security administration and management | Knowledge or skill | Covered | Network Forensics: Traffic Capture from Switches & Routers |
| Cyber incident responder | Network security architecture | Knowledge or skill | Covered | Incident Response: Architecting an IR-Friendly Network |
| Cyber incident responder | Software defined security and application security | Knowledge or skill | Partial | Security Operations Fundamentals: Web Application Firewalls (WAFs): Protecting Web Apps |
| Cyber incident responder | Virtualization and VPN security | Knowledge or skill | Partial | Malware Analysis: Monitoring Malware's Network Activity |
| Cyber incident responder | Cloud-based security | Knowledge or skill | Covered | Active Directory Attack and Defense: Pass-the-PRT: Detection and Response |
| Cyber incident responder | IT security zoning | Knowledge or skill | Covered | Incident Response: Architecting an IR-Friendly Network |
| Cyber incident responder | Encryption and cryptography including key management concepts and principles | Knowledge or skill | Partial | Active Directory Attack and Defense: Silver SAML: Attack Mechanics and Walkthrough |
| Cyber incident responder | Vulnerability scanning and analysis | Knowledge or skill | Covered | Security Operations Fundamentals: [Walkthrough] Nessus: Perform an Authenticated Advanced Scan |
| Cyber incident responder | Vulnerability management tools, processes and procedures | Knowledge or skill | Covered | Security Operations Fundamentals: Understanding Vulnerability Management Process. |
| Cyber incident responder | Web application security | Knowledge or skill | Covered | Security Operations Fundamentals: Web Application Firewalls (WAFs): Protecting Web Apps |
| Cyber incident responder | Configuration and operational build books | Knowledge or skill | Partial | Incident Response: IR Procedure |
| Cyber incident responder | Legal and ethical responsibilities associated with cyber security operations including conduct of investigations, privacy, and preservation of evidence | Knowledge or skill | Partial | Forensics Evidence Collection: Acquisition |
| Cyber incident responder | Writing and briefing on technical matters (e.g. incident reports, technical reports, etc.) for managerial level understanding | Knowledge or skill | Covered | Incident Response: Incident Report |
| Cyber incident responder | Business continuity and disaster response basics | Knowledge or skill | Partial | Incident Response: Restore, Validate, and Monitor |
| Cyber incident responder | Network security appliance concepts, operation and configuration (equipment specific based on role - network, server and desktop cyber defence systems and/or appliances) | Knowledge or skill | Covered | Incident Response: [Walkthrough] Suricata |
| Cyber incident responder | Types of intrusions and indicators of compromise (IoCs) | Knowledge or skill | Covered | Network Forensics: Analyzing Extracted Objects from Network Traffic |
| Cyber incident responder | Sources of threat information | Knowledge or skill | Covered | Security Operations Fundamentals: Threat Intelligence: Mitigating and Defending |
| Cyber incident responder | Common threat actor tactics, techniques, and procedures (TTPs) | Knowledge or skill | Covered | Threat Hunting: MITRE ATT&CK: Mapping a Full Attack Scenario |
| Cyber incident responder | Incident management processes, responsibilities and authorities | Knowledge or skill | Covered | Incident Response: IR Policy |
| Cyber incident responder | Intrusion detection and prevention methodologies, tools and systems | Knowledge or skill | Covered | Incident Response: [Walkthrough] Writing Custom Suricata Signatures |
| Cyber incident responder | Intrusion analysis and mitigation techniques | Knowledge or skill | Covered | Incident Response: Root Cause Analysis (RCA) |
| Cyber incident responder | Basic malware analysis | Knowledge or skill | Covered | Malware Analysis: Intro to Malware Analysis |
| Cyber incident responder | Cyber security investigations and evidence preservation | Knowledge or skill | Covered | Forensics Evidence Collection: Acquisition |
| Cyber incident responder | Operating systems, networking, and communications systems concepts | Knowledge or skill | Partial | Network Forensics: PCAP Analysis: Detailed Protocol Analysis |
| Cyber incident responder | Analysis tools and network protocols | Knowledge or skill | Partial | Network Forensics: PCAP Analysis: Detailed Protocol Analysis |
| Cyber incident responder | Perform real-time cyber defense incident handling tasks (e.g. forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) | Task | Covered | Incident Response: [Walkthrough] Capturing a Memory Dump for an Infected Process using Velociraptor |
| Cyber incident responder | Conduct security triage to identify and analyze cyber incidents and threats | Task | Covered | Incident Response: Incident Prioritization |
| Cyber incident responder | Actively monitor networks and systems for cyber incidents and threats | Task | Covered | Incident Response: [Walkthrough] Writing Custom Suricata Signatures |
| Cyber incident responder | Conduct risk analysis and security reviews of system logs to identify possible cyber threats | Task | Covered | Incident Response: Incident Prioritization |
| Cyber incident responder | Conduct analysis and review, and/or apply network scanners, vulnerability assessment tools, network protocols, Internet security protocols, intrusion detection systems, firewalls, content checkers and endpoint software | Task | Covered | Security Operations Fundamentals: [Walkthrough] Nessus: Perform an Authenticated Advanced Scan |
| Cyber incident responder | Collect and analyze data to identify cyber security flaws and vulnerabilities and make recommendations that enable prompt remediation | Task | Covered | Security Operations Fundamentals: Understanding Vulnerability Management Process. |
| Cyber incident responder | Develop and prepare cyber defence incident analysis and reporting | Task | Covered | Incident Response: Incident Report |
| Cyber incident responder | Define and maintain tool sets and procedures | Task | Partial | Incident Response: IR Procedure |
| Cyber incident responder | Develop, implement, and evaluate prevention and incident response plans and activities, and adapt to contain, mitigate or eradicate effects of cyber security incident | Task | Covered | Incident Response: IR Plan |
| Cyber incident responder | Provide incident analysis support on response plans and activities | Task | Covered | Incident Response: Root Cause Analysis (RCA) |
| Cyber incident responder | Conduct research and development on cyber security incidents and mitigation | Task | Partial | Incident Response: [Walkthrough] Writing Custom Suricata Signatures |
| Cyber incident responder | Create a program development plan that includes security gap assessments, policies, procedures, playbooks, and training manuals | Task | Partial | Security Operations Fundamentals: Efficient SOC Procedures: The How-To |
| Cyber incident responder | Review, develop and deliver relevant training material | Task | Partial | Security Operations Fundamentals: Creating Effective Cybersecurity Training Plans |
| Digital forensics analyst | Threat actor tools, techniques and procedures | Knowledge or skill | Covered | Threat Hunting: MITRE ATT&CK: Mapping a Full Attack Scenario |
| Digital forensics analyst | Incident response and handling methodologies | Knowledge or skill | Covered | Incident Response: NIST Incident Response Lifecycle |
| Digital forensics analyst | Security Event and Incident Management System | Knowledge or skill | Covered | Threat Hunting: Elastic Stack: Components and Architecture |
| Digital forensics analyst | Digital forensics methodologies, processes and practices | Knowledge or skill | Covered | Forensics Evidence Collection: Acquisition |
| Digital forensics analyst | Anti-forensics tactics, techniques, and procedure | Knowledge or skill | Partial | Memory Forensics: Exploring MFT entries: Use case |
| Digital forensics analyst | Processes for collecting, packaging, transporting, and storing electronic evidence to avoid alteration, loss, physical damage, or destruction of data | Knowledge or skill | Partial | Forensics Evidence Collection: Acquisition |
| Digital forensics analyst | Seizing and preserving digital evidence | Knowledge or skill | Partial | Forensics Evidence Collection: Acquisition |
| Digital forensics analyst | Applicable laws, regulations, policies and ethics as they relate to investigations and governance | Knowledge or skill | Partial | Network Forensics: Full Packet Captures (PCAPs) |
| Digital forensics analyst | System or device specific forensics (e.g. memory, active director, mobile device, network, computer [dead box], etc.) | Knowledge or skill | Covered | Memory Forensics: Exploring MFT entries: Use case |
| Digital forensics analyst | Malware analysis tools and techniques | Knowledge or skill | Partial | Malware Analysis: Intro to Malware Analysis |
| Digital forensics analyst | Reverse engineering | Knowledge or skill | Partial | Malware Analysis: Debugging VBA Macros Step-by-Step |
| Digital forensics analyst | Deployable digital forensics capabilities | Knowledge or skill | Covered | Incident Response: [Walkthrough] Overview of Velociraptor Deployment and Interface |
| Digital forensics analyst | Types of digital forensics including tools, techniques and procedures (organization and information system dependent) which may include the following forensics for: computer network and Active Directory mobile devices digital media (image, video, audio) memory | Knowledge or skill | Partial | Forensics Evidence Collection: Digital Forensic Types |
| Digital forensics analyst | Perform real-time cyber defence incident investigations (e.g. forensic collections, intrusion correlation and tracking, and threat analysis) | Task | Covered | Incident Response: [Walkthrough] Capturing a Memory Dump for an Infected Process using Velociraptor |
| Digital forensics analyst | Investigate security incidents as per terms of reference | Task | Partial | Incident Response: IR Policy |
| Digital forensics analyst | Plan forensics analysis activities for cyber incidents | Task | Covered | Forensics Evidence Collection: Acquisition |
| Digital forensics analyst | Collect and analyze intrusion artifacts (e.g. source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber defense incidents | Task | Covered | Malware Analysis: Debugging VBA Macros Step-by-Step |
| Digital forensics analyst | Identify and accurately report on digital forensic analysis artifacts | Task | Covered | Incident Response: Incident Report |
| Digital forensics analyst | Capture and analyze network traffic associated with malicious activities using network monitoring tools | Task | Covered | Network Forensics: Traffic Capture from Switches & Routers |
| Digital forensics analyst | Contribute to post-analysis on security incidents and make recommendations based on forensics activities | Task | Covered | Incident Response: Lessons Learned Meeting |
| Digital forensics analyst | Develop and maintain investigative and technical reports | Task | Covered | Incident Response: Incident Tracking |
| Digital forensics analyst | Provide technical assistance on digital evidence matters to appropriate personnel | Task | Partial | Security Operations Fundamentals: Creating Effective Cybersecurity Training Plans |
| Digital forensics analyst | Manage digital evidence in accordance with appropriate chain of custody requirements | Task | Partial | Incident Response: Containment |
| Digital forensics analyst | Identify and manage secure analysis infrastructure/laboratory | Task | Covered | Malware Analysis: Monitoring Malware's Network Activity |
| Digital forensics analyst | Operate digital forensics systems (as required based on function and systems available) | Task | Covered | Forensics Evidence Collection: Walkthrough - Evidence Collection: KAPE |
| Digital forensics analyst | Prepare and review forensics policies, standards, procedures and guidelines | Task | Partial | Incident Response: IR Procedure |
| Digital forensics analyst | Develop, deliver, and oversee training material and educational efforts | Task | Partial | Security Operations Fundamentals: Creating Effective Cybersecurity Training Plans |
Train for the roles these frameworks describe
Defend Smarter, Not Harder