CyberDefenders certifications mapped to the Saudi Cybersecurity Workforce Framework
CCDL1 and CCDL2 align to five SCyWF 1.5 roles, including Cybersecurity Defense Analyst, Incident Responder, Digital Forensics Specialist, and Threat Hunter. CCDL2 also aligns to Malware Reverse Engineering Specialist.
Last reviewed: October 2026
What is the SCyWF?
The Saudi Cybersecurity Workforce Framework (SCyWF) is the National Cybersecurity Authority's reference for cybersecurity jobs in Saudi Arabia. It defines work roles and the tasks, knowledge, and skills each role needs.
NCA recommends that organizations in Saudi Arabia use it to plan, hire, and develop their cybersecurity teams. The current version is SCyWF 1.5:2026.
Which SCyWF roles does CCDL1 align to?
CCDL1 aligns to Cybersecurity Defense Analyst, Cybersecurity Specialist, Cybersecurity Incident Responder, Digital Forensics Specialist, and Threat Hunter, at an entry level.
Learners correlate events, triage alerts, scope and contain incidents, acquire and analyze forensic evidence, and run hypothesis-led threat hunts with MITRE ATT&CK.
Which SCyWF roles does CCDL2 align to?
CCDL2 aligns to the same five roles in more depth, and adds Malware Reverse Engineering Specialist.
Learners run endpoint and network investigations, follow the full incident response process, analyze disk, memory, and network evidence, hunt APT activity, and analyze malicious executables and VBA macros.
How did we map CCDL1 and CCDL2 to the SCyWF?
We scored every task, knowledge, and skill statement in 11 SCyWF 1.5 roles against the live, published lessons and labs of each course.
Each statement is marked Covered, Partially covered, or Not evidenced, with the lesson or lab that supports it. We screened all 40 SCyWF roles before choosing which to score. The mapping was captured in October 2026 and is reviewed yearly.
How can teams in Saudi Arabia use this mapping?
- Match SOC, incident response, and forensics hires to SCyWF roles.
- Plan training against the roles your organization uses under NCA guidance.
- Show HR which SCyWF roles your training covers.
Building a SOC team? See our cybersecurity training for teams and enterprises.
What SCyWF tasks do the courses cover?
A sample of SCyWF 1.5 tasks the courses fully cover, with where they are taught.
| Statement ID | SCyWF task | Role | Where it is taught |
|---|---|---|---|
| T0009 | Correlate incident data | Cybersecurity Incident Responder | CCDL1: Module 3: SIEM & Log Analysis: Lab 3.1.2: Event Correlation |
| T0028 | Perform cyber defense trend analysis and reporting | Cybersecurity Defense Analyst | CCDL2: Threat Hunting: Elastic SIEM |
| T0030 | Perform file signature analysis | Digital Forensics Specialist | CCDL1: Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| T0021 | Identify data or intelligence of evidentiary value | Threat Hunter | CCDL2: Incident Response: Phase 3: Containment, Eradication, and Recovery |
| T0026 | Identify potential threats to network resources | Cybersecurity Specialist | CCDL1: Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| T0089 | Use reverse engineering tools | Malware Reverse Engineering Specialist | CCDL2: Malware Analysis: Static Analysis |
View the full CCDL1 and CCDL2 SCyWF mapping
Roles: DA = Cybersecurity Defense Analyst, INF = Cybersecurity Infrastructure Specialist, CS = Cybersecurity Specialist, IAM = Identity and Access Management Specialist, VA = Vulnerability Assessment Specialist, IR = Cybersecurity Incident Responder, DF = Digital Forensics Specialist, CCI = Cyber Crime Investigator, MRE = Malware Reverse Engineering Specialist, TI = Threat Intelligence Analyst, TH = Threat Hunter. Statements with no evidence in the live course are not listed.
CCDL1: 424 statements covered or partially covered
| ID | SCyWF statement | Type | Coverage | Roles | Where it is taught |
|---|---|---|---|---|---|
| T0005 | Implement system cybersecurity controls | Task | Partial | CS, INF | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| T0009 | Correlate incident data | Task | Covered | CS, DA, IR, TH, VA | Module 3: SIEM & Log Analysis: Lab 3.1.2: Event Correlation |
| T0015 | Use cybersecurity products and security control technologies to reduce identified risk to an acceptable level | Task | Partial | DA | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| T0017 | Establish stakeholder communication channels | Task | Partial | TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0018 | Establish internal and external cross-team relationships | Task | Partial | CCI, TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0021 | Identify data or intelligence of evidentiary value | Task | Covered | CCI, TH | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| T0025 | Escalate incidents that may cause ongoing and immediate impact to the environment | Task | Covered | DA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0026 | Identify potential threats to network resources | Task | Covered | CS, IR, TH | Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| T0027 | Perform cybersecurity incident triage | Task | Covered | IR, TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0028 | Perform cyber defense trend analysis and reporting | Task | Partial | CS, DA, IR, TH | Module 3: SIEM & Log Analysis: Lab 3.2.3: Splunk Alerts and Dashboards |
| T0029 | Determine the effectiveness of an observed attack | Task | Covered | DA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0030 | Perform file signature analysis | Task | Covered | DF, TH | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| T0031 | Recommend mitigation and remediation strategies for enterprise systems | Task | Covered | IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0032 | Perform real-time forensic analysis | Task | Partial | DF, TH | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| T0033 | Perform timeline analysis | Task | Covered | DF, TH | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| T0037 | Perform cybersecurity reviews of security architecture to inform risk mitigation strategies | Task | Partial | DA | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| T0038 | Perform system administration on specialized cyber defense applications and systems | Task | Partial | INF | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T0040 | Recommend system modifications to close identified vulnerabilities | Task | Covered | DA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0044 | Determine causes of network alerts | Task | Covered | DA, IR | Module 3: SIEM & Log Analysis: Lab 3.2.3: Splunk Alerts and Dashboards |
| T0047 | Track cyber defense incidents from initial detection through final resolution | Task | Partial | IR | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T0049 | Capture network traffic associated with malicious activities | Task | Covered | DF, TH | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| T0051 | Produce incident findings reports | Task | Covered | IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0054 | Detect cybersecurity attacks and intrusions | Task | Covered | DA, TH | Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| T0055 | Perform continuous monitoring of system activity | Task | Partial | DA, TH | Module 3: SIEM & Log Analysis: Lab 3.2.3: Splunk Alerts and Dashboards |
| T0056 | Determine impact of malicious activity on systems and information | Task | Covered | DA, TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0057 | Identify, prioritize and coordinate the protection of critical cyber defense infrastructure and resources | Task | Partial | INF, TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0058 | Employ defense-in-depth principles and practices in line with organizational policies | Task | Partial | IR | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T0060 | Create auditable evidence of security measures | Task | Partial | TH | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| T0062 | Mitigate potential cyber defense incidents | Task | Covered | IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0067 | Identify network traffic anomalies | Task | Covered | DA | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| T0068 | Identify indications and warnings through research, analysis and correlation across multiple data sets | Task | Covered | DA | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| T0069 | Validate intrusion detection system alerts | Task | Covered | DA, TH | Module 3: SIEM & Log Analysis: Lab 3.2.3: Splunk Alerts and Dashboards |
| T0070 | Remove malware | Task | Partial | DA | Module 2: Network & Endpoint Security: Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint |
| T0071 | Analyze network traffic to identify a device's environment components | Task | Covered | DA | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| T0072 | Use network traffic to reconstruct malicious activity | Task | Covered | DA | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| T0073 | Identify network mapping and operating system (OS) fingerprinting activities | Task | Partial | DA | Module 2: Network & Endpoint Security: Lab 2.1.3: Detect Port Scans, Beaconing and C2 Patterns |
| T0075 | Construct cyber defense network tool signatures | Task | Covered | DA | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| T0076 | Report suspected cyber incidents in line with the organization's cyber incident response plan | Task | Covered | DA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0080 | Collect metrics and trending data | Task | Partial | TH | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T0087 | Prepare after action reviews (AARs) | Task | Partial | IR | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T0089 | Use reverse engineering tools | Task | Partial | MRE, TH | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| T0097 | Analyze organizational cybersecurity posture trends | Task | Partial | DA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T0098 | Develop system security posture trend reports | Task | Partial | DA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T0100 | Determine adequacy of access controls | Task | Covered | DA, IAM | Module 5: Cloud Threat Detection: Lab 5.1.1: Cloud and Azure Fundamentals |
| T0101 | Maintain currency of cyber defense threat conditions | Task | Partial | DA, IR | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T0102 | Determine effectiveness of system implementation and testing processes | Task | Partial | CS, DA | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| T0106 | Coordinate incident response functions | Task | Partial | IR | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T0107 | Recommend threat and vulnerability risk mitigation strategies | Task | Covered | DA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0111 | Work with stakeholders to resolve cybersecurity incidents and vulnerability compliance issues | Task | Partial | DA | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T0113 | Perform technical and nontechnical risk and vulnerability assessments of organizational technology environments | Task | Partial | CS, VA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T0122 | Notify appropriate personnel of imminent hostile intentions or activities | Task | Covered | DA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0133 | Perform continuous monitoring | Task | Partial | VA | Module 3: SIEM & Log Analysis: Lab 3.2.3: Splunk Alerts and Dashboards |
| T0138 | Determine the operational impacts of cybersecurity breaches | Task | Covered | DA, IR, VA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0140 | Maintain stakeholder communication channels | Task | Partial | TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0141 | Document cybersecurity incidents | Task | Covered | DA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0142 | Identify anomalous network activity | Task | Covered | CS, IR, TH | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| T0143 | Recommend incident remediation strategies | Task | Covered | IR, TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0144 | Determine the scope, urgency, and impact of cybersecurity incidents | Task | Covered | IR, TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0145 | Perform forensically sound image collection | Task | Covered | IR | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| T0148 | Document cyber defense incidents from initial detection through final resolution | Task | Partial | IR | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T0149 | Analyze network traffic associated with malicious activities | Task | Covered | DF, TH | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| T0150 | Communicate incident findings to appropriate constituencies | Task | Covered | IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0151 | Communicate cybersecurity attacks and intrusions alerts | Task | Covered | DA, TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T0152 | Distinguish between benign and potentially malicious cybersecurity attacks and intrusions | Task | Covered | DA, TH | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T0154 | Collect intrusion artifacts | Task | Covered | IR | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| T0155 | Analyze network traffic anomalies | Task | Covered | DA | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| T0156 | Perform network packet analysis | Task | Covered | DA, TH | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| T0157 | Isolate malware | Task | Covered | DA | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| T0159 | Develop organizational cybersecurity posture trend reports | Task | Partial | DA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T1025 | Determine relevance of recovered data | Task | Covered | DA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T1528 | Promote cybersecurity awareness to management | Task | Partial | TH | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T3500 | Deploy cyber defense tools | Task | Partial | CS, DA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T3502 | Administer rule and signature updates for specialized cyber defense applications | Task | Covered | INF | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| T3503 | Validate network alerts | Task | Covered | CS, DA | Module 3: SIEM & Log Analysis: Lab 3.2.3: Splunk Alerts and Dashboards |
| T3504 | Communicate daily network event and activity reports | Task | Partial | CS, DA | Module 3: SIEM & Log Analysis: Lab 3.2.3: Splunk Alerts and Dashboards |
| T3511 | Document functional descriptions of system security control implementations | Task | Partial | INF | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| T4018 | Determine if identity access management implementations follow organization's standards and policies | Task | Partial | IAM | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| T4019 | Identify and address gaps in the identity access management implementation | Task | Partial | IAM | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| T4024 | Develop group policies | Task | Partial | IAM | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| T4025 | Administer system and network user accounts | Task | Partial | IAM | Module 5: Cloud Threat Detection: Lab 5.1.1: Cloud and Azure Fundamentals |
| T4029 | Implement access control processes for continuous monitoring tools and technologies | Task | Partial | IAM | Module 5: Cloud Threat Detection: Lab 5.1.1: Cloud and Azure Fundamentals |
| T4501 | Conduct required reviews, including reviews of defensive measures, according to the organization’s policies | Task | Partial | VA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T5000 | Determine best methods for identifying the perpetrator(s) of a network intrusion | Task | Partial | DF | Module 4: Digital Forensics: Lab 4.2.3: User Activity and Browser Forensics |
| T5002 | Identify intrusions | Task | Covered | DF | Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| T5003 | Resolve cyber defense incidents | Task | Partial | IR | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T5004 | Create forensically sound duplicates of evidence | Task | Covered | DF | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| T5005 | Investigate suspicious activity and alleged digital crimes | Task | Partial | CCI | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| T5006 | Create technical summary of findings reports | Task | Covered | DF | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5007 | Ensure that chain of custody is followed for all acquired digital media in accordance with national law or organizational policies as applicable | Task | Partial | DF | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| T5008 | Conduct analysis of computer network attacks | Task | Covered | CCI | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| T5009 | Determine if security incidents are indicative of a violation of law that requires specific legal action | Task | Partial | CCI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5010 | Identify digital evidence for analysis | Task | Covered | CCI, DF, TH | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| T5012 | Collect documentary or physical evidence of cyber intrusion incidents, investigations, and operations | Task | Partial | CCI | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| T5013 | Perform dynamic analysis on drives | Task | Partial | DF | Module 2: Network & Endpoint Security: Lab 2.2.2: Investigate Linux Security Logs with Auditd |
| T5014 | Perform hash comparison against databases required by organizational policies | Task | Partial | DF | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| T5015 | Perform static media analysis | Task | Covered | DF | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| T5016 | Perform tier 1, 2 and 3 malware analysis | Task | Partial | DF, MRE, TH | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| T5017 | Prepare digital media for imaging | Task | Covered | DF | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| T5019 | Process digital evidence | Task | Covered | DF | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| T5020 | Recognize and report forensic artifacts in line with reporting policies | Task | Partial | DF | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5022 | Extract data from devices | Task | Covered | DF | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| T5023 | Recover information from forensic data sources | Task | Covered | CCI, DF, TH | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| T5024 | Conduct binary analysis | Task | Partial | DF | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| T5026 | Scan digital media for viruses | Task | Partial | DF | Module 2: Network & Endpoint Security: Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint |
| T5027 | Perform forensic analysis of file systems | Task | Covered | DF | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| T5029 | Perform static malware analysis | Task | Partial | DF | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| T5031 | Correlate threat assessment data | Task | Covered | DF, IR | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T5034 | Determine the impact of threats on cybersecurity | Task | Covered | CCI | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T5036 | Process forensic images | Task | Partial | DF | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| T5037 | Perform Windows registry analysis | Task | Covered | DF | Module 4: Digital Forensics: Lab 4.2.1: System Profiling and Registry Forensics |
| T5038 | Perform file and registry monitoring on running systems | Task | Partial | DF | Module 2: Network & Endpoint Security: Lab 2.2.2: Investigate Linux Security Logs with Auditd |
| T5040 | Report cyber incidents to inform cyber defense | Task | Covered | CCI, DF, IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5041 | Prepare cyber defense toolkits | Task | Partial | DF | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| T5042 | Analyze material from cybersecurity incidents for evidence of hostile foreign actor or criminal activity | Task | Partial | CCI | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T5043 | Preserve digital evidence | Task | Covered | CCI | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| T5045 | Conduct log file analysis | Task | Covered | DF | Module 5: Cloud Threat Detection: Lab 5.1.2: Azure Log Analysis and KQL Fundamentals |
| T5046 | Identify responsible parties for intrusions and other crimes | Task | Partial | CCI | Module 4: Digital Forensics: Lab 4.2.3: User Activity and Browser Forensics |
| T5047 | Document original condition of digital evidence | Task | Partial | CCI | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| T5049 | Prepare investigative reports | Task | Covered | CCI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5052 | Review gathered information for validity and relevance to the investigation in line with organizational policies | Task | Partial | MRE | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5057 | Document lessons learned during events and exercises | Task | Partial | CCI, DA, DF, IR, MRE | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T5058 | Identify potential malicious activity from memory dumps, logs and packet captures | Task | Covered | MRE | Module 4: Digital Forensics: Lab 4.2.4: Windows Memory Forensics |
| T5062 | Identify intrusion via dynamic analysis | Task | Partial | DF | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| T5064 | Document what is known about intrusions | Task | Covered | DF | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5065 | Analyze intrusions | Task | Covered | DF | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| T5066 | Coordinate technical support to enterprise-wide cybersecurity defense technicians | Task | Partial | IR | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T5067 | Recommend potential courses of action | Task | Covered | CCI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5500 | Recommend new or revised security, resilience, and dependability measures | Task | Partial | TH | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T5504 | Enhance incident response plans based on Knowledge about threat actors and activities | Task | Partial | TI | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| T5505 | Coordinate, validate and manage the organization's cyber threat intelligence sources and feeds | Task | Partial | TI | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T5507 | Prepare and deliver briefs on specific threats to the organization | Task | Partial | TH, TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5509 | Conduct network scouting | Task | Partial | TH | Module 3: SIEM & Log Analysis: Lab 3.3.2: Threat Hunting Case 2 |
| T5511 | Detect exploits against targeted networks and hosts | Task | Covered | TH | Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| T5512 | Determine what technologies are used by a given target | Task | Covered | TH | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| T5514 | Collect and analyze threat actors data | Task | Partial | TH | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T5517 | Identify organization's principal cyber threats | Task | Partial | TH, TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5519 | Identify cyber threat tactics and methodologies | Task | Covered | MRE, TH, TI | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| T5520 | Identify vulnerabilities | Task | Partial | TH | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| T5523 | Develop courses of action based on threat factors | Task | Covered | TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5525 | Monitor threat activities | Task | Partial | MRE, TH, TI | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| T5527 | Monitor and report threat actor activities | Task | Partial | TI | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| T5530 | Provide intelligence analysis and support | Task | Partial | TI | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T5531 | Prepare network intrusion reports | Task | Covered | TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5532 | Perform real-time cyber defense incident handling | Task | Partial | TH | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T5535 | Maintain a common intelligence picture | Task | Partial | MRE, TI | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T5537 | Develop priority information requirements | Task | Partial | MRE, TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5538 | Generate requests for cybersecurity information | Task | Partial | MRE, TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| T5539 | Produce timely, fused, all-source cyber operations intelligence and/or indications and warnings intelligence products | Task | Partial | MRE, TI | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| T5547 | Prepare threat activity reports | Task | Covered | MRE, TH, TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0001 | Knowledge of network components and operations | Knowledge | Covered | CCI, CS, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| K0002 | Knowledge of risk assessment principles and practices | Knowledge | Partial | CCI, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0003 | Knowledge of cybersecurity laws and regulations | Knowledge | Partial | CCI, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0004 | Knowledge of cybersecurity principles and practices | Knowledge | Covered | CCI, CS, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| K0005 | Knowledge of cybersecurity threats | Knowledge | Covered | CCI, CS, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| K0007 | Knowledge of authentication and authorization tools and techniques | Knowledge | Covered | CS, DA, IAM | Module 5: Cloud Threat Detection: Lab 5.1.1: Cloud and Azure Fundamentals |
| K0009 | Knowledge of common application vulnerabilities | Knowledge | Partial | CS, VA | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K0013 | Knowledge of cyber defense tools and techniques | Knowledge | Covered | CS, DA, IAM, TH | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| K0017 | Knowledge of cryptography principles and practices | Knowledge | Partial | CS, DA, INF, VA | Module 1: Phishing Analysis: Lab 1.1.1: Email Foundations |
| K0024 | Knowledge of host access control (HAC) systems and software | Knowledge | Covered | CS, DA, IAM, INF, IR, VA | Module 5: Cloud Threat Detection: Lab 5.1.1: Cloud and Azure Fundamentals |
| K0025 | Knowledge of network communications principles and practices | Knowledge | Covered | IR | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| K0031 | Knowledge of information sources for identifying and effectively addressing vulnerabilities | Knowledge | Partial | CS, DA, TH | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| K0032 | Knowledge of incident response principles and practices | Knowledge | Covered | IR, TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0035 | Knowledge of Confidentiality, Integrity and Availability (CIA) principles and practices | Knowledge | Partial | CS, DA, IAM, INF, TH, VA | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| K0042 | Knowledge of identity and access management (IAM) principles and practices | Knowledge | Covered | DA, IAM, VA | Module 5: Cloud Threat Detection: Lab 5.1.1: Cloud and Azure Fundamentals |
| K0043 | Knowledge of network traffic analysis tools and techniques | Knowledge | Covered | CS, DA, INF, IR, MRE, TH, TI | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| K0045 | Knowledge of operating system (OS) principles | Knowledge | Covered | CS, DA, DF | Module 2: Network & Endpoint Security: Lab 2.2.1: Analyze Windows Process Activity and Event Logs |
| K0046 | Knowledge of network traffic protocols | Knowledge | Covered | DA, INF, VA | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| K0047 | Knowledge of packet-level analysis tools and techniques | Knowledge | Covered | IR, MRE, TH | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| K0049 | Knowledge of policy-based access controls | Knowledge | Covered | DA, IAM | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| K0051 | Knowledge of programming language structures and logic | Knowledge | Partial | CS, VA | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K0053 | Knowledge of cybersecurity management principles and practices | Knowledge | Partial | CS, DA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| K0059 | Knowledge of data management tools and techniques | Knowledge | Partial | IAM | Module 3: SIEM & Log Analysis: Lab 3.1.1: Log Collection |
| K0063 | Knowledge of virtual private network (VPN) systems and software | Knowledge | Partial | CS, DA, INF | Module 5: Cloud Threat Detection: Lab 5.2.1: Triaging Sign-In Alerts |
| K0064 | Knowledge of network attack characteristics | Knowledge | Covered | DA, INF, IR, TH, VA | Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| K0066 | Knowledge of computer physical components | Knowledge | Partial | DF, TI | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| K0068 | Knowledge of network tools and techniques | Knowledge | Covered | CS, DA, TH | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| K0069 | Knowledge of defense-in-depth principles and practices | Knowledge | Covered | DA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| K0070 | Knowledge of network communication types | Knowledge | Covered | DA | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| K0072 | Knowledge of file extensions | Knowledge | Covered | DA | Module 1: Phishing Analysis: Lab 1.2.1: Email Threats |
| K0075 | Knowledge of digital forensics data characteristics | Knowledge | Covered | DF | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| K0076 | Knowledge of interpreted and compiled computer languages | Knowledge | Partial | DA, VA | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K0077 | Knowledge of threat intelligence sources, capabilities and limitations | Knowledge | Covered | DA | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| K0084 | Knowledge of cybersecurity policies and procedures | Knowledge | Partial | CS, DA, INF, IR | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| K0085 | Knowledge of the organization's IT user security policies | Knowledge | Partial | IAM | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| K0086 | Knowledge of network attack vectors | Knowledge | Covered | DA, TH | Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| K0087 | Knowledge of cyberattack characteristics | Knowledge | Covered | DA, IR, VA | Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| K0088 | Knowledge of cyberattack actor characteristics | Knowledge | Partial | DA, IR, TH, VA | Module 3: SIEM & Log Analysis: Lab 3.1.2: Event Correlation |
| K0090 | Knowledge of system administration, network management and operating system hardening methods | Knowledge | Partial | DA, DF, IR, VA | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| K0096 | Knowledge of networking protocols | Knowledge | Covered | MRE | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| K0097 | Knowledge of software reverse engineering tools and techniques | Knowledge | Partial | MRE | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K0099 | Knowledge of the stages of a cyberattack | Knowledge | Covered | DA, IR, MRE, TI, VA | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| K0100 | Knowledge of network architecture principles and practices | Knowledge | Partial | DA, DF, INF, IR, MRE, VA | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| K0102 | Knowledge of encryption tools and techniques | Knowledge | Partial | DA, MRE | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| K0103 | Knowledge of malware signature principles and practices | Knowledge | Partial | DA, MRE | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| K0104 | Knowledge of Windows ports and services | Knowledge | Partial | CS, DA, INF, MRE | Module 2: Network & Endpoint Security: Lab 2.3.2: Analyze Authentication Events and Account Management Logs |
| K0106 | Knowledge of cloud computing principles and practices | Knowledge | Covered | IAM | Module 5: Cloud Threat Detection: Lab 5.1.1: Cloud and Azure Fundamentals |
| K0107 | Knowledge of data classification standards and best practices | Knowledge | Partial | IAM, TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0113 | Knowledge of industry cybersecurity standards and frameworks | Knowledge | Covered | DA, VA | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| K0119 | Knowledge of operating system administration principles and practices | Knowledge | Partial | CS, DF, INF, VA | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| K0121 | Knowledge of cloud service models and frameworks | Knowledge | Covered | IR | Module 5: Cloud Threat Detection: Lab 5.1.1: Cloud and Azure Fundamentals |
| K0123 | Knowledge of malware analysis principles and practices | Knowledge | Partial | IR | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K0124 | Knowledge of Personally Identifiable Information (PII) data security standards and best practices | Knowledge | Partial | DA, IAM | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0125 | Knowledge of Payment Card Industry (PCI) data security standards and best practices | Knowledge | Partial | DA, IAM | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0126 | Knowledge of data security standards relating to the sector in which the organization operates | Knowledge | Partial | DA, IAM | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0133 | Knowledge of cybersecurity data classification tools and techniques | Knowledge | Partial | IAM, IR, VA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0134 | Knowledge of cybersecurity system testing tools and techniques | Knowledge | Partial | DA | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| K0136 | Knowledge of countermeasure design principles and practices | Knowledge | Partial | DA | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| K0137 | Knowledge of network mapping principles and practices | Knowledge | Partial | DA | Module 2: Network & Endpoint Security: Lab 2.1.3: Detect Port Scans, Beaconing and C2 Patterns |
| K0144 | Knowledge of cybersecurity information sharing principles and practices | Knowledge | Partial | IAM | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0145 | Knowledge of command-line tools and techniques | Knowledge | Covered | DA | Module 3: SIEM & Log Analysis: Lab 3.2.2: SPL Basics |
| K0147 | Knowledge of Intrusion Detection System (IDS) tools and techniques | Knowledge | Covered | DA, INF | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| K0169 | Knowledge of data compromise reporting policies and procedures | Knowledge | Covered | IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0170 | Knowledge of hexadecimal data | Knowledge | Covered | CCI, MRE | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K0171 | Knowledge of code analysis tools and techniques | Knowledge | Partial | CCI, CS, DF, IR, MRE | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K0175 | Knowledge of network firewall principles and practices | Knowledge | Covered | IAM | Module 2: Network & Endpoint Security: Lab 2.2.2: Investigate Linux Security Logs with Auditd |
| K0177 | Knowledge of network configurations | Knowledge | Partial | DA, INF, TI | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| K0184 | Knowledge of security orchestration, automation, and response (SOAR) tools and techniques | Knowledge | Partial | CS, DA, INF, IR, TI, VA | Module 5: Cloud Threat Detection: Lab 5.1.2: Azure Log Analysis and KQL Fundamentals |
| K0186 | Knowledge of cybersecurity controls | Knowledge | Covered | CCI, CS, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| K0187 | Knowledge of risk mitigation principles and practices | Knowledge | Partial | CCI, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0188 | Knowledge of data protection principles and practices | Knowledge | Covered | CCI, CS, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| K0189 | Knowledge of cybersecurity vulnerabilities | Knowledge | Partial | CCI, CS, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K0190 | Knowledge of access control methods | Knowledge | Covered | CS, DA, IAM | Module 5: Cloud Threat Detection: Lab 5.1.1: Cloud and Azure Fundamentals |
| K0191 | Knowledge of vulnerability assessment tools and techniques | Knowledge | Partial | CS, DA, IAM, TH | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| K0195 | Knowledge of incident response policies and procedures | Knowledge | Covered | IR, TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0196 | Knowledge of incident response tools and techniques | Knowledge | Covered | IR, TH | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| K0198 | Knowledge of insider threat tools and techniques | Knowledge | Partial | CCI, DA, TH | Module 4: Digital Forensics: Lab 4.2.3: User Activity and Browser Forensics |
| K0199 | Knowledge of insider threat operational indicators | Knowledge | Partial | CCI, DA, TH | Module 4: Digital Forensics: Lab 4.2.3: User Activity and Browser Forensics |
| K0201 | Knowledge of insider threat tactics | Knowledge | Partial | CCI, DA, TH | Module 4: Digital Forensics: Lab 4.2.3: User Activity and Browser Forensics |
| K0202 | Knowledge of insider threat targets | Knowledge | Partial | CCI, DA, TH | Module 4: Digital Forensics: Lab 4.2.3: User Activity and Browser Forensics |
| K0203 | Knowledge of computer peripherals | Knowledge | Partial | DF, TI | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| K0205 | Knowledge of network cybersecurity principles and practices | Knowledge | Covered | DA, DF, INF, IR, MRE, VA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| K0206 | Knowledge of Unix ports and services | Knowledge | Partial | CS, DA, INF, MRE | Module 2: Network & Endpoint Security: Lab 2.2.2: Investigate Linux Security Logs with Auditd |
| K0211 | Knowledge of cybersecurity information sharing tools and techniques | Knowledge | Partial | IAM | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K0213 | Knowledge of penetration testing tools and techniques | Knowledge | Partial | DA, VA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| K0214 | Knowledge of red team functions and capabilities | Knowledge | Partial | DA, VA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| K1052 | Knowledge of data storage principles and practices | Knowledge | Partial | INF | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| K1503 | Knowledge of client and server architecture | Knowledge | Covered | DF | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| K3506 | Knowledge of protocol analyzer tools and techniques | Knowledge | Covered | DA | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| K3507 | Knowledge of organizational cybersecurity incident response plans | Knowledge | Covered | DA, IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K3508 | Knowledge of ransomware defense tools and techniques | Knowledge | Partial | DA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K4000 | Knowledge of remote access principles and practices | Knowledge | Covered | IAM | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| K4001 | Knowledge of the capabilities and functionality associated with content creation technologies | Knowledge | Partial | IAM | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K4002 | Knowledge of the capabilities and functionality of collaborative technologies and their implications for cybersecurity | Knowledge | Partial | IAM | Module 5: Cloud Threat Detection: Lab 5.1.2: Azure Log Analysis and KQL Fundamentals |
| K4016 | Knowledge of reporting policies and procedures | Knowledge | Covered | IAM | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K4024 | Knowledge of Kerberos authentication principles and practices | Knowledge | Covered | IAM | Module 2: Network & Endpoint Security: Lab 2.3.2: Analyze Authentication Events and Account Management Logs |
| K4026 | Knowledge of Role-Based Access Control (RBAC) principles and practices | Knowledge | Covered | IAM | Module 5: Cloud Threat Detection: Lab 5.1.1: Cloud and Azure Fundamentals |
| K4028 | Knowledge of Single Sign-On (SSO) principles and practices | Knowledge | Covered | IAM | Module 5: Cloud Threat Detection: Lab 5.1.1: Cloud and Azure Fundamentals |
| K4029 | Knowledge of Single Sign-On (SSO) tools and techniques | Knowledge | Covered | IAM | Module 5: Cloud Threat Detection: Lab 5.1.1: Cloud and Azure Fundamentals |
| K4030 | Knowledge of remote access tools and techniques | Knowledge | Covered | IAM | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| K4511 | Knowledge of cybersecurity adversarial tactics principles and practices | Knowledge | Covered | IR | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| K4512 | Knowledge of cybersecurity adversarial tactics tools and techniques | Knowledge | Covered | IR | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| K4514 | Knowledge of red, blue, and purple teaming principles and practices | Knowledge | Partial | IR, VA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| K5001 | Knowledge of the main types of electronic devices and their capabilities | Knowledge | Partial | CCI | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| K5002 | Knowledge of file system implementation principles and practices | Knowledge | Covered | DF | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| K5003 | Knowledge of digital evidence seizure policies and procedures | Knowledge | Partial | CCI, DF | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| K5006 | Knowledge of digital evidence preservation policies and procedures | Knowledge | Covered | CCI, DF | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| K5007 | Knowledge of chain of custody policies and procedures | Knowledge | Partial | CCI, DF | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| K5008 | Knowledge of persistent data principles and practices | Knowledge | Covered | CCI, DF | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| K5009 | Knowledge of web mail tools and techniques | Knowledge | Partial | DF | Module 5: Cloud Threat Detection: Lab 5.1.2: Azure Log Analysis and KQL Fundamentals |
| K5010 | Knowledge of system file characteristics | Knowledge | Covered | DF | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| K5011 | Knowledge of deployable forensics principles and practices | Knowledge | Partial | DF | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| K5014 | Knowledge of event correlation tools and techniques | Knowledge | Covered | DF | Module 3: SIEM & Log Analysis: Lab 3.1.2: Event Correlation |
| K5015 | Knowledge of electronic evidence laws and regulations | Knowledge | Partial | CCI, DF | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| K5017 | Knowledge of data carving tools and techniques | Knowledge | Partial | DF, MRE | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| K5019 | Knowledge of anti-forensics tools and techniques | Knowledge | Covered | DF, MRE | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| K5021 | Knowledge of debugging tools and techniques | Knowledge | Partial | DF, MRE | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K5022 | Knowledge of filename extension abuse | Knowledge | Covered | DF, MRE | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K5023 | Knowledge of malware analysis tools and techniques | Knowledge | Partial | DF, MRE | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K5025 | Knowledge of crisis management protocols | Knowledge | Partial | CCI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K5028 | Knowledge of binary analysis tools and techniques | Knowledge | Partial | DF | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K5033 | Knowledge of digital forensics tools and techniques | Knowledge | Covered | CCI, DF | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| K5034 | Knowledge of data integrity principles and practices | Knowledge | Covered | CCI, DF | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| K5037 | Knowledge of chain of custody processes | Knowledge | Partial | DF | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| K5039 | Knowledge of deployable forensics tools and techniques | Knowledge | Partial | DF | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| K5041 | Knowledge of crisis management processes | Knowledge | Partial | CCI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K5042 | Knowledge of crisis management tools and techniques | Knowledge | Partial | CCI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K5502 | Knowledge of cyberattack tools and techniques | Knowledge | Covered | TI | Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| K5503 | Knowledge of data classification policies and procedures | Knowledge | Partial | CCI, DA, DF, IAM, IR, TH, TI, VA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K5505 | Knowledge of computer networking principles and practices | Knowledge | Covered | TH, TI | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| K5510 | Knowledge of cyber operations principles and practices | Knowledge | Partial | TH, TI | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| K5511 | Knowledge of host-based security products and their capabilities | Knowledge | Covered | TI | Module 2: Network & Endpoint Security: Lab 2.2.1: Analyze Windows Process Activity and Event Logs |
| K5513 | Knowledge of electronic communication systems threats and risks | Knowledge | Covered | TI | Module 1: Phishing Analysis: Lab 1.1.1: Email Foundations |
| K5519 | Knowledge of the tactics an organization can employ to anticipate and counter an attacker's capabilities and actions | Knowledge | Covered | TH, TI | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| K5520 | Knowledge of network addressing principles and practices | Knowledge | Partial | TI | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| K5521 | Knowledge of cyber threat actors | Knowledge | Partial | TH | Module 3: SIEM & Log Analysis: Lab 3.1.2: Event Correlation |
| K5522 | Knowledge of performing threat environment analysis | Knowledge | Partial | TH | Module 3: SIEM & Log Analysis: Lab 3.3.2: Threat Hunting Case 2 |
| K5523 | Knowledge of malware | Knowledge | Covered | TI | Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| K5524 | Knowledge of cyber decision-making policies and procedures | Knowledge | Covered | TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| K5525 | Knowledge of cyber threat actors functions and capabilities | Knowledge | Partial | TH | Module 3: SIEM & Log Analysis: Lab 3.1.2: Event Correlation |
| K5526 | Knowledge of cyber threat actors tools and techniques | Knowledge | Covered | TH | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| K5531 | Knowledge of threat systems and software | Knowledge | Partial | TH, TI | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| K5536 | Knowledge of analytical tools and techniques | Knowledge | Covered | CS, TI | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| K5537 | Knowledge of threat hunting principles and practices | Knowledge | Covered | TH | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| S0002 | Skill in identifying malware | Skill | Covered | CS, IR | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S0004 | Skill in applying core cybersecurity principles | Skill | Covered | IR | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| S0005 | Skill in applying host access controls | Skill | Partial | IAM, INF | Module 2: Network & Endpoint Security: Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint |
| S0009 | Skill in detecting host-based and network-based intrusions | Skill | Covered | CS, DA, INF, IR, VA | Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| S0012 | Skill in evaluating cybersecurity system designs | Skill | Partial | CS, DA, IR | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| S0013 | Skill in preserving digital evidence integrity | Skill | Covered | CCI, DF, IR | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| S0014 | Skill in configuring network sensors | Skill | Partial | INF, IR | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| S0015 | Skill in using protocol analyzer tools | Skill | Covered | DA, IR | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| S0018 | Skill in solving problems | Skill | Covered | CCI, IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S0020 | Skill in performing digital forensics analysis | Skill | Covered | DF, IR | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| S0021 | Skill in configuring and utilizing computer protection tools | Skill | Covered | CS, INF | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| S0022 | Skill in securing network communications | Skill | Partial | CS, INF, IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S0023 | Skill in categorizing types of vulnerabilities | Skill | Partial | CS, DA, IR | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S0025 | Skill in performing damage assessments | Skill | Covered | IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S0026 | Skill in performing network data analysis | Skill | Covered | IR, VA | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| S0027 | Skill in configuring network protection components | Skill | Partial | CS, IR | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| S0028 | Skill in conducting cybersecurity audits or reviews of technical systems | Skill | Partial | CS | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| S0029 | Skill in using binary analysis tools | Skill | Partial | DF, MRE, TH | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S0030 | Skill in implementing one-way hash functions | Skill | Partial | DF, MRE, TH | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| S0031 | Skill in reading Hexadecimal data | Skill | Covered | MRE, TH | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S0032 | Skill in identifying common encoding techniques | Skill | Covered | MRE, TH | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| S0033 | Skill in reading digital signatures | Skill | Partial | DA, IR | Module 1: Phishing Analysis: Lab 1.1.1: Email Foundations |
| S0035 | Skill in applying hardening techniques | Skill | Partial | CS, INF, IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S0037 | Skill in conducting application vulnerability assessments | Skill | Partial | VA | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S0040 | Skill in assessing cybersecurity controls | Skill | Partial | DA, INF | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| S0041 | Skill in performing packet-level analysis | Skill | Covered | DA, DF, IR | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| S0044 | Skill in performing risk assessments | Skill | Partial | IR, VA | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S0046 | Skill in performing event correlation | Skill | Covered | DA, IR | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| S0048 | Skill in performing root cause analysis | Skill | Covered | DA, IR, MRE | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| S0050 | Skill in performing target system analysis | Skill | Partial | TH | Module 3: SIEM & Log Analysis: Lab 3.3.2: Threat Hunting Case 2 |
| S0051 | Skill in preparing briefings | Skill | Partial | IR, TH, TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S0052 | Skill in recognizing abnormal network activity in traffic | Skill | Covered | IR, MRE, TH | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| S0053 | Skill in performing reverse engineering of software | Skill | Partial | MRE, TH | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S0054 | Skill in analyzing tools, techniques, and procedures used by adversaries remotely to exploit and establish persistence on a target | Skill | Covered | IR | Module 4: Digital Forensics: Lab 4.2.1: System Profiling and Registry Forensics |
| S0056 | Skill in performing threat analysis | Skill | Covered | DA, TH, TI, VA | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| S0057 | Skill in bridging the gap between threat intelligence and strategy effectiveness | Skill | Partial | DA | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| S0058 | Skill in communicating effectively | Skill | Covered | TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S0059 | Skill in identifying cybersecurity threats | Skill | Covered | TH | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S0060 | Skill in responding effectively to cyber incidents in cloud environment | Skill | Covered | IR | Module 5: Cloud Threat Detection: Lab 5.2.2: Investigating Application Abuse |
| S0061 | Skill in applying confidentiality, integrity, and availability (CIA) principles | Skill | Partial | DA, IAM, INF, VA | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| S0062 | Skill in using risk management techniques | Skill | Partial | CS, TH | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S0063 | Skill in utilizing cyber defense service providers | Skill | Partial | DA | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| S0068 | Skill in analyzing software configurations | Skill | Covered | CCI, CS, DF, INF, IR, MRE, TH, VA | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| S0069 | Skill in performing network data flow analysis | Skill | Covered | CCI, DA, DF, INF, TH | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| S0076 | Skill in mitigating deception in reporting and analysis | Skill | Partial | TH, TI | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| S0077 | Skill in applying critical thinking | Skill | Covered | MRE, TH, TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S0082 | Skill in identifying critical information systems | Skill | Covered | INF | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S0086 | Skill in communicating cybersecurity concepts and practices effectively | Skill | Covered | TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S0092 | Skill in identifying vulnerabilities in security systems | Skill | Partial | CS, DA, INF, MRE, TH, VA | Module 2: Network & Endpoint Security: Lab 2.3.1: Explore Active Directory Architecture in a Live Environment |
| S0093 | Skill in capturing malware | Skill | Covered | CS, IR | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| S0094 | Skill in containing malware | Skill | Covered | CS, IR | Module 2: Network & Endpoint Security: Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint |
| S0095 | Skill in reporting malware | Skill | Covered | CS, IR | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S0096 | Skill in applying network access controls | Skill | Partial | IAM, INF | Module 2: Network & Endpoint Security: Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint |
| S0100 | Skill in using one-way hash functions | Skill | Covered | DF, MRE, TH | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| S0101 | Skill in interpreting digital signatures | Skill | Partial | DA, IR | Module 1: Phishing Analysis: Lab 1.1.1: Email Foundations |
| S0103 | Skill in presenting to an audience | Skill | Partial | IR, TH, TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S0104 | Skill in interpreting abnormal network activity in traffic | Skill | Covered | CS, DA, IR, MRE, TH | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| S0505 | Skill in translating operational requirements into security controls | Skill | Partial | TI | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| S1007 | Skill in developing cybersecurity system controls | Skill | Partial | IAM, INF | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| S1009 | Skill in preparing reports | Skill | Covered | TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S1020 | Skill in performing data analysis | Skill | Covered | TI | Module 3: SIEM & Log Analysis: Lab 3.2.2: SPL Basics |
| S1022 | Skill in using outlier identification and removal techniques | Skill | Partial | IR | Module 3: SIEM & Log Analysis: Lab 3.3.2: Threat Hunting Case 2 |
| S1023 | Skill in writing computer scripts to automate tasks | Skill | Partial | IR, VA | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| S1038 | Skill in identifying forensic digital footprints | Skill | Covered | CCI, DF | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| S1039 | Skill in performing static code analysis | Skill | Partial | CCI, DF, MRE | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S1504 | Skill in collaborating with internal and external stakeholders | Skill | Partial | IAM, TI | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| S2002 | Skill in performing network traffic analysis | Skill | Covered | DA, IR | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| S2506 | Skill in reviewing logs | Skill | Covered | IR, VA | Module 5: Cloud Threat Detection: Lab 5.1.2: Azure Log Analysis and KQL Fundamentals |
| S2507 | Skill in troubleshooting cyber defense infrastructure anomalies | Skill | Partial | INF | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| S2517 | Skill in identifying intelligence gaps and limitations | Skill | Covered | TI | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| S2523 | Skill in prioritizing information | Skill | Covered | IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S2525 | Skill in interpreting and evaluating metadata | Skill | Covered | TH | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| S2533 | Skill in analyzing reports and recommending actions to be taken | Skill | Covered | IR | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| S2537 | Skill in performing intelligence collection analysis | Skill | Partial | TI | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| S2542 | Skill in reviewing corporate strategies or applicable legal, regulatory or policy documents to identify issues requiring clarification or action | Skill | Partial | TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S2543 | Skill in developing appropriate and effective requirements to inform selection of cyber threat intelligence sources or monitoring activity | Skill | Partial | DA, TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S2550 | Skill in functioning effectively in a dynamic, fast-paced environment | Skill | Partial | TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S2552 | Skill in mitigating cognitive biases | Skill | Partial | TI | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| S2557 | Skill in identifying evidence of past intrusions | Skill | Covered | IR, VA | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| S3500 | Skill in using incident handling methodologies | Skill | Covered | DA, INF, IR | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S3501 | Skill in collecting data from a variety of cybersecurity resources | Skill | Covered | CS, DA, IR, TI | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| S3502 | Skill in conducting trend analysis | Skill | Partial | CS, DA | Module 3: SIEM & Log Analysis: Lab 3.2.3: Splunk Alerts and Dashboards |
| S4000 | Skill in conducting information searches | Skill | Covered | IAM | Module 3: SIEM & Log Analysis: Lab 3.2.2: SPL Basics |
| S4005 | Skill in managing account access rights | Skill | Partial | IAM | Module 2: Network & Endpoint Security: Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint |
| S4006 | Skill in collecting network data | Skill | Covered | CS, DA, INF | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| S4504 | Skill in using penetration testing tools and techniques | Skill | Partial | VA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| S4505 | Skill in performing social engineering | Skill | Covered | VA | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| S4507 | Skill in assessing an organization's threat environment | Skill | Partial | TH, VA | Module 3: SIEM & Log Analysis: Lab 3.3.2: Threat Hunting Case 2 |
| S5000 | Skill in performing memory dump analysis | Skill | Covered | DF, IR | Module 4: Digital Forensics: Lab 4.2.4: Windows Memory Forensics |
| S5001 | Skill in identifying forensics data in diverse media | Skill | Partial | DF, IR | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| S5002 | Skill in manipulating operating system components | Skill | Partial | DF, IR | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| S5003 | Skill in collecting digital evidence | Skill | Covered | CCI, DF, IR | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| S5005 | Skill in using digital forensic tools | Skill | Covered | DF, IR | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| S5008 | Skill in performing source code analysis | Skill | Partial | DF, IR, MRE, TH | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S5009 | Skill in performing volatile data analysis | Skill | Covered | DF, IR, MRE, TH | Module 4: Digital Forensics: Lab 4.2.4: Windows Memory Forensics |
| S5010 | Skill in identifying obfuscation techniques | Skill | Covered | DF, IR, MRE, TH | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| S5012 | Skill in performing malware analysis | Skill | Partial | DA, DF, IR, MRE, TH | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S5013 | Skill in performing bit-level analysis | Skill | Partial | DF, IR, MRE | Module 4: Digital Forensics: Lab 4.2.4: Windows Memory Forensics |
| S5014 | Skill in processing digital evidence | Skill | Covered | DF, IR, MRE | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| S5018 | Skill in identifying anomalous activity | Skill | Covered | DA, TH | Module 2: Network & Endpoint Security: Lab 2.1.1: Map Network Traffic - Ports, Protocols and Baseline Behavior |
| S5019 | Skill in performing file system forensic analysis | Skill | Covered | CCI, DF | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| S5020 | Skill in extracting information from packet captures | Skill | Covered | CCI, DF | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| S5021 | Skill in performing dynamic analysis | Skill | Partial | CCI, DF | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S5024 | Skill in examining digital media | Skill | Covered | CCI, DF | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| S5025 | Skill in navigating system files | Skill | Covered | CCI, CS, DF, IAM, IR, MRE, TH, TI, VA | Module 4: Digital Forensics: Lab 4.2.1: System Profiling and Registry Forensics |
| S5026 | Skill in identifying filename extension abuse | Skill | Covered | DA, DF | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S5027 | Skill in recognizing digital forensics data | Skill | Covered | DF | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| S5029 | Skill in using deployable forensics toolkits | Skill | Covered | DF | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| S5030 | Skill in extracting forensics data in diverse media | Skill | Partial | DF, IR | Module 4: Digital Forensics: Lab 4.1.1: Introduction to Digital Forensics |
| S5031 | Skill in performing digital evidence analysis | Skill | Covered | CCI, DF, IR | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| S5033 | Skill in storing digital evidence | Skill | Partial | CCI, DF, IR | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| S5034 | Skill in creating digital evidence copies | Skill | Covered | DF, IR, MRE | Module 4: Digital Forensics: Lab 4.1.2: Evidence Acquisition and Triage Collection |
| S5501 | Skill in defining an operational environment | Skill | Partial | IR, TI | Module 3: SIEM & Log Analysis: Lab 3.3.2: Threat Hunting Case 2 |
| S5502 | Skill in developing or recommending analytic approaches in situations where information is incomplete or for which no precedent exists | Skill | Partial | IR, TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S5503 | Skill in evaluating potential sources of information for their value to a cyber investigation | Skill | Covered | DA, IR, TH, TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S5504 | Skill in evaluating information quality | Skill | Covered | IR, TI | Module 6: Incident Handling Process: Lab 6.1.1: The SOC Decision Process |
| S5515 | Skill in analyzing threat intelligence products | Skill | Partial | TH | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| S5516 | Skill in performing data queries | Skill | Covered | TI | Module 3: SIEM & Log Analysis: Lab 3.2.2: SPL Basics |
| S5517 | Skill in using data analytics tools | Skill | Covered | TI | Module 3: SIEM & Log Analysis: Lab 3.2.2: SPL Basics |
| S5518 | Skill in conducting open-source searches | Skill | Partial | TI | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
| S5519 | Skill in using network analysis and reconstruction tools | Skill | Covered | TH | Module 2: Network & Endpoint Security: Lab 2.1.2: Capture and Analyze PCAP Traffic |
| S5523 | Skill in monitoring threat or vulnerability situation and environmental factors | Skill | Partial | TH | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| S5524 | Skill in assessing the implication of cyber attacks on third parties | Skill | Partial | DA, TH | Module 6: Incident Handling Process: Lab 6.1.2: From Alerts to Handover |
| S5525 | Skill in performing intrusion data analysis | Skill | Covered | DA, TI | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| S5526 | Skill in evaluating security products | Skill | Partial | INF | Module 2: Network & Endpoint Security: Lab 2.1.4: Write and Test Basic IDS Rules |
| S5527 | Skill in extracting metadata | Skill | Covered | CCI, DF, MRE | Module 4: Digital Forensics: Lab 4.2.2: File System Artifacts and Execution Analysis |
| S5528 | Skill in performing threat emulation tactics | Skill | Partial | TH, TI | Module 1: Phishing Analysis: Lab 1.4.1: Phishing Simulation |
| S5531 | Skill in thinking like threat actors | Skill | Covered | MRE, TH, TI | Module 2: Network & Endpoint Security: Lab 2.3.3: Detect Abnormal Logins, Lateral Movement and Privilege Escalation |
| S5532 | Skill in identifying advance persistent threats (APTs) | Skill | Partial | CS, DA, INF, IR, TH, TI, VA | Module 3: SIEM & Log Analysis: Lab 3.1.2: Event Correlation |
| S5533 | Skill in threat hunting | Skill | Covered | TH | Module 3: SIEM & Log Analysis: Lab 3.3.1: Threat Hunting Case 1 |
| S5534 | Skill in recognizing network, operating system and application deception techniques | Skill | Partial | IR, TH | Module 1: Phishing Analysis: Lab 1.3.1: Email Threat Detection and Analysis |
CCDL2: 525 statements covered or partially covered
| ID | SCyWF statement | Type | Coverage | Roles | Where it is taught |
|---|---|---|---|---|---|
| T0003 | Evaluate organizational cybersecurity policy regulatory compliance | Task | Partial | VA | Security Operations Fundamentals: SOC Components: Processes |
| T0005 | Implement system cybersecurity controls | Task | Partial | CS, INF | Perimeter Defense - Email Security: Email Spoofing |
| T0009 | Correlate incident data | Task | Covered | CS, DA, IR, TH, VA | Active Directory Attack and Defense: Lab 1.2.3: Identifying AD Attack Patterns in Event Logs |
| T0010 | Perform technical decryption of seized data | Task | Partial | DF | Network Forensics: Understanding Network Data Sources |
| T0015 | Use cybersecurity products and security control technologies to reduce identified risk to an acceptable level | Task | Partial | DA | Perimeter Defense - Email Security: Email Spoofing |
| T0017 | Establish stakeholder communication channels | Task | Partial | TH | Incident Response: Phase 1: Preparation |
| T0018 | Establish internal and external cross-team relationships | Task | Partial | CCI, TH | Incident Response: Phase 1: Preparation |
| T0021 | Identify data or intelligence of evidentiary value | Task | Covered | CCI, TH | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| T0024 | Maintain deployable cyber defense audit toolkits | Task | Partial | VA | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| T0025 | Escalate incidents that may cause ongoing and immediate impact to the environment | Task | Partial | DA | Incident Response: Incident Response Overiew |
| T0026 | Identify potential threats to network resources | Task | Covered | CS, IR, TH | Network Forensics: Extracting IoCs & Objects |
| T0027 | Perform cybersecurity incident triage | Task | Covered | IR, TH | Perimeter Defense - Email Security: Responding to Email Attacks |
| T0028 | Perform cyber defense trend analysis and reporting | Task | Covered | CS, DA, IR, TH | Threat Hunting: Elastic SIEM |
| T0029 | Determine the effectiveness of an observed attack | Task | Covered | DA | Network Forensics: Extracting IoCs & Objects |
| T0030 | Perform file signature analysis | Task | Covered | DF, TH | Network Forensics: Extracting IoCs & Objects |
| T0031 | Recommend mitigation and remediation strategies for enterprise systems | Task | Covered | IR | Incident Response: Remediation/Eradication |
| T0032 | Perform real-time forensic analysis | Task | Partial | DF, TH | Incident Response: Phase 2: Detection & Analysis |
| T0033 | Perform timeline analysis | Task | Covered | DF, TH | Disk Forensics: Collecting File and Folder Activity |
| T0035 | Mitigate programming vulnerabilities | Task | Partial | TH | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T0037 | Perform cybersecurity reviews of security architecture to inform risk mitigation strategies | Task | Partial | DA | Incident Response: Phase 1: Preparation |
| T0038 | Perform system administration on specialized cyber defense applications and systems | Task | Partial | INF | Threat Hunting: Elastic SIEM |
| T0040 | Recommend system modifications to close identified vulnerabilities | Task | Covered | DA | Incident Response: Remediation/Eradication |
| T0041 | Prepare audit reports | Task | Partial | VA | Security Operations Fundamentals: SOC Components: Processes |
| T0044 | Determine causes of network alerts | Task | Covered | DA, IR | Network Forensics: Extracting IoCs & Objects |
| T0047 | Track cyber defense incidents from initial detection through final resolution | Task | Covered | IR | Incident Response: Incident Response Overiew |
| T0049 | Capture network traffic associated with malicious activities | Task | Covered | DF, TH | Network Forensics: Understanding Network Data Sources |
| T0051 | Produce incident findings reports | Task | Covered | IR | Incident Response: Phase 4: Post-Incident Activity |
| T0054 | Detect cybersecurity attacks and intrusions | Task | Covered | DA, TH | Network Forensics: Extracting IoCs & Objects |
| T0055 | Perform continuous monitoring of system activity | Task | Covered | DA, TH | Threat Hunting: Elastic SIEM |
| T0056 | Determine impact of malicious activity on systems and information | Task | Covered | DA, TH | Network Forensics: Extracting IoCs & Objects |
| T0057 | Identify, prioritize and coordinate the protection of critical cyber defense infrastructure and resources | Task | Partial | INF, TH | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T0058 | Employ defense-in-depth principles and practices in line with organizational policies | Task | Partial | IR | Incident Response: Phase 1: Preparation |
| T0060 | Create auditable evidence of security measures | Task | Partial | TH | Active Directory Attack and Defense: Lab 1.2.3: Identifying AD Attack Patterns in Event Logs |
| T0062 | Mitigate potential cyber defense incidents | Task | Covered | IR | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| T0067 | Identify network traffic anomalies | Task | Covered | DA | Network Forensics: Preparing Network Captures for Network Analysis |
| T0068 | Identify indications and warnings through research, analysis and correlation across multiple data sets | Task | Covered | DA | Threat Hunting: Methodology-Based Hunting |
| T0069 | Validate intrusion detection system alerts | Task | Covered | DA, TH | Network Forensics: Extracting IoCs & Objects |
| T0070 | Remove malware | Task | Covered | DA | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| T0071 | Analyze network traffic to identify a device's environment components | Task | Covered | DA | Network Forensics: Understanding Network Data Types |
| T0072 | Use network traffic to reconstruct malicious activity | Task | Covered | DA | Network Forensics: Extracting IoCs & Objects |
| T0073 | Identify network mapping and operating system (OS) fingerprinting activities | Task | Partial | DA | Network Forensics: Extracting IoCs & Objects |
| T0075 | Construct cyber defense network tool signatures | Task | Covered | DA | Incident Response: Phase 2: Detection & Analysis |
| T0076 | Report suspected cyber incidents in line with the organization's cyber incident response plan | Task | Partial | DA | Incident Response: Phase 1: Preparation |
| T0080 | Collect metrics and trending data | Task | Covered | TH | Threat Hunting: Elastic SIEM |
| T0087 | Prepare after action reviews (AARs) | Task | Covered | IR | Incident Response: Phase 4: Post-Incident Activity |
| T0089 | Use reverse engineering tools | Task | Covered | MRE, TH | Malware Analysis: Static Analysis |
| T0097 | Analyze organizational cybersecurity posture trends | Task | Partial | DA | Threat Hunting: Elastic SIEM |
| T0098 | Develop system security posture trend reports | Task | Partial | DA | Threat Hunting: Elastic SIEM |
| T0100 | Determine adequacy of access controls | Task | Covered | DA, IAM | Active Directory Attack and Defense: Lab 1.1.7: Analyzing Azure AD External Identity and Trust Security - Cross-Tenant Trust, Conditional Access, and Token-Based Attacks |
| T0101 | Maintain currency of cyber defense threat conditions | Task | Partial | DA, IR | Threat Hunting: Methodology-Based Hunting |
| T0102 | Determine effectiveness of system implementation and testing processes | Task | Partial | CS, DA | Active Directory Attack and Defense: Lab 1.1.7: Analyzing Azure AD External Identity and Trust Security - Cross-Tenant Trust, Conditional Access, and Token-Based Attacks |
| T0106 | Coordinate incident response functions | Task | Partial | IR | Incident Response: Phase 1: Preparation |
| T0107 | Recommend threat and vulnerability risk mitigation strategies | Task | Covered | DA | Incident Response: Remediation/Eradication |
| T0111 | Work with stakeholders to resolve cybersecurity incidents and vulnerability compliance issues | Task | Partial | DA | Incident Response: Phase 1: Preparation |
| T0113 | Perform technical and nontechnical risk and vulnerability assessments of organizational technology environments | Task | Partial | CS, VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T0122 | Notify appropriate personnel of imminent hostile intentions or activities | Task | Partial | DA | Incident Response: Incident Response Overiew |
| T0133 | Perform continuous monitoring | Task | Covered | VA | Threat Hunting: Elastic SIEM |
| T0138 | Determine the operational impacts of cybersecurity breaches | Task | Covered | DA, IR, VA | Incident Response: Incident Response Overiew |
| T0139 | Evaluate organizational cybersecurity policy alignment with organizational directives | Task | Partial | VA | Security Operations Fundamentals: SOC Components: Processes |
| T0140 | Maintain stakeholder communication channels | Task | Partial | TH | Incident Response: Phase 1: Preparation |
| T0141 | Document cybersecurity incidents | Task | Covered | DA | Incident Response: Phase 4: Post-Incident Activity |
| T0142 | Identify anomalous network activity | Task | Covered | CS, IR, TH | Network Forensics: Preparing Network Captures for Network Analysis |
| T0143 | Recommend incident remediation strategies | Task | Covered | IR, TH | Incident Response: Remediation/Eradication |
| T0144 | Determine the scope, urgency, and impact of cybersecurity incidents | Task | Covered | IR, TH | Perimeter Defense - Email Security: Responding to Email Attacks |
| T0145 | Perform forensically sound image collection | Task | Covered | IR | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| T0148 | Document cyber defense incidents from initial detection through final resolution | Task | Covered | IR | Incident Response: Incident Response Overiew |
| T0149 | Analyze network traffic associated with malicious activities | Task | Covered | DF, TH | Network Forensics: Extracting IoCs & Objects |
| T0150 | Communicate incident findings to appropriate constituencies | Task | Partial | IR | Incident Response: Phase 4: Post-Incident Activity |
| T0151 | Communicate cybersecurity attacks and intrusions alerts | Task | Partial | DA, TH | Incident Response: Phase 4: Post-Incident Activity |
| T0152 | Distinguish between benign and potentially malicious cybersecurity attacks and intrusions | Task | Covered | DA, TH | Memory Forensics: Understanding Windows Processes: Exploring Memory, Threads, and Processes Relationships |
| T0154 | Collect intrusion artifacts | Task | Covered | IR | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| T0155 | Analyze network traffic anomalies | Task | Covered | DA | Network Forensics: Preparing Network Captures for Network Analysis |
| T0156 | Perform network packet analysis | Task | Covered | DA, TH | Network Forensics: Extracting IoCs & Objects |
| T0157 | Isolate malware | Task | Covered | DA | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| T0159 | Develop organizational cybersecurity posture trend reports | Task | Partial | DA | Threat Hunting: Elastic SIEM |
| T1025 | Determine relevance of recovered data | Task | Partial | DA | Memory Forensics: Understanding Windows Processes: Exploring Memory, Threads, and Processes Relationships |
| T1049 | Develop cybersecurity designs to meet specific operational needs and environmental factors | Task | Partial | IAM | Incident Response: Phase 1: Preparation |
| T1528 | Promote cybersecurity awareness to management | Task | Partial | TH | Incident Response: Phase 4: Post-Incident Activity |
| T3500 | Deploy cyber defense tools | Task | Covered | CS, DA | Incident Response: Phase 2: Detection & Analysis |
| T3502 | Administer rule and signature updates for specialized cyber defense applications | Task | Covered | INF | Incident Response: Phase 2: Detection & Analysis |
| T3503 | Validate network alerts | Task | Covered | CS, DA | Network Forensics: Extracting IoCs & Objects |
| T3504 | Communicate daily network event and activity reports | Task | Partial | CS, DA | Threat Hunting: Elastic SIEM |
| T3506 | Assist in assessing the impact of implementing and sustaining a dedicated cyber defense infrastructure | Task | Partial | INF | Security Operations Fundamentals: Security Operations Fundamentals |
| T3507 | Evaluate platforms managed by service providers | Task | Partial | INF | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T3508 | Manage network access control lists on specialized cyber defense systems | Task | Partial | IAM, INF | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T4016 | Design and deploy identity access management solutions | Task | Partial | IAM | Active Directory Attack and Defense: Lab 1.1.2: SAML Authentication and Silver SAML in Entra ID (2) |
| T4017 | Develop the identity access management strategy | Task | Partial | IAM | Active Directory Attack and Defense: Lab 1.1.2: SAML Authentication and Silver SAML in Entra ID (2) |
| T4018 | Determine if identity access management implementations follow organization's standards and policies | Task | Partial | IAM | Active Directory Attack and Defense: Lab 1.1.2: SAML Authentication and Silver SAML in Entra ID (2) |
| T4019 | Identify and address gaps in the identity access management implementation | Task | Covered | IAM | Active Directory Attack and Defense: Lab 1.1.7: Analyzing Azure AD External Identity and Trust Security - Cross-Tenant Trust, Conditional Access, and Token-Based Attacks |
| T4023 | Develop processes and procedures for manual updating and patching of system software | Task | Partial | INF | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T4024 | Develop group policies | Task | Partial | IAM | Active Directory Attack and Defense: Lab 1.1.4: Analyzing AD Trust Security Configurations - GPO Abuse at the Site Level |
| T4025 | Administer system and network user accounts | Task | Partial | IAM | Incident Response: Remediation/Eradication |
| T4026 | Develop system administration and management functionality for privileged access users | Task | Partial | IAM | Active Directory Attack and Defense: Lab 1.2.1: Detecting Kerberos-Based Attacks in Event Logs |
| T4027 | Establish systems and equipment access protocols | Task | Partial | IAM | Incident Response: Phase 1: Preparation |
| T4028 | Establish access control processes for continuous monitoring tools and technologies | Task | Partial | IAM | Incident Response: Phase 2: Detection & Analysis |
| T4029 | Implement access control processes for continuous monitoring tools and technologies | Task | Partial | IAM | Incident Response: Phase 2: Detection & Analysis |
| T4035 | Develop access control lists | Task | Partial | IAM | Active Directory Attack and Defense: Lab 1.2.3: Identifying AD Attack Patterns in Event Logs |
| T4036 | Design system administration and management functionality for privileged access users | Task | Partial | IAM | Active Directory Attack and Defense: Lab 1.2.1: Detecting Kerberos-Based Attacks in Event Logs |
| T4500 | Perform authorized penetration testing on enterprise network assets | Task | Partial | VA | Active Directory Attack and Defense: Lab 1.1.4: Analyzing AD Trust Security Configurations - GPO Abuse at the Site Level |
| T4501 | Conduct required reviews, including reviews of defensive measures, according to the organization’s policies | Task | Partial | VA | Security Operations Fundamentals: SOC Components: Processes |
| T4502 | Recommend cost-effective security controls | Task | Partial | VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T4507 | Carry out vulnerability scanning on system | Task | Covered | VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T5000 | Determine best methods for identifying the perpetrator(s) of a network intrusion | Task | Partial | DF | Threat Hunting: Methodology-Based Hunting |
| T5002 | Identify intrusions | Task | Covered | DF | Network Forensics: Extracting IoCs & Objects |
| T5003 | Resolve cyber defense incidents | Task | Partial | IR | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| T5004 | Create forensically sound duplicates of evidence | Task | Covered | DF | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| T5005 | Investigate suspicious activity and alleged digital crimes | Task | Covered | CCI | Memory Forensics: Understanding Windows Processes: Exploring Memory, Threads, and Processes Relationships |
| T5006 | Create technical summary of findings reports | Task | Covered | DF | Incident Response: Phase 4: Post-Incident Activity |
| T5007 | Ensure that chain of custody is followed for all acquired digital media in accordance with national law or organizational policies as applicable | Task | Partial | DF | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| T5008 | Conduct analysis of computer network attacks | Task | Covered | CCI | Network Forensics: Extracting IoCs & Objects |
| T5010 | Identify digital evidence for analysis | Task | Covered | CCI, DF, TH | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| T5012 | Collect documentary or physical evidence of cyber intrusion incidents, investigations, and operations | Task | Covered | CCI | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| T5013 | Perform dynamic analysis on drives | Task | Partial | DF | Forensics Evidence Collection: Mounting Forensic Images: Analysis Tools & Techniques |
| T5014 | Perform hash comparison against databases required by organizational policies | Task | Partial | DF | Malware Analysis: Static Analysis |
| T5015 | Perform static media analysis | Task | Covered | DF | Disk Forensics: Collecting File and Folder Activity |
| T5016 | Perform tier 1, 2 and 3 malware analysis | Task | Partial | DF, MRE, TH | Malware Analysis: Static Analysis |
| T5017 | Prepare digital media for imaging | Task | Covered | DF | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| T5018 | Process crime scenes | Task | Partial | CCI | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| T5019 | Process digital evidence | Task | Covered | DF | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| T5020 | Recognize and report forensic artifacts in line with reporting policies | Task | Partial | DF | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| T5022 | Extract data from devices | Task | Covered | DF | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| T5023 | Recover information from forensic data sources | Task | Covered | CCI, DF, TH | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| T5024 | Conduct binary analysis | Task | Covered | DF | Malware Analysis: Static Analysis |
| T5026 | Scan digital media for viruses | Task | Covered | DF | Forensics Evidence Collection: Mounting Forensic Images: Analysis Tools & Techniques |
| T5027 | Perform forensic analysis of file systems | Task | Covered | DF | Disk Forensics: Collecting File and Folder Activity |
| T5028 | Perform static analysis to mount an "image" of a drive; with or without the original | Task | Covered | DF | Forensics Evidence Collection: Mounting Forensic Images: Analysis Tools & Techniques |
| T5029 | Perform static malware analysis | Task | Covered | DF | Malware Analysis: Static Analysis |
| T5031 | Correlate threat assessment data | Task | Partial | DF, IR | Threat Hunting: Methodology-Based Hunting |
| T5034 | Determine the impact of threats on cybersecurity | Task | Partial | CCI | Threat Hunting: Methodology-Based Hunting |
| T5036 | Process forensic images | Task | Covered | DF | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| T5037 | Perform Windows registry analysis | Task | Covered | DF | Disk Forensics: Windows Forensics |
| T5038 | Perform file and registry monitoring on running systems | Task | Covered | DF | Malware Analysis: Dynamic Analysis |
| T5039 | Enter digital media information into tracking databases | Task | Partial | DF | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| T5040 | Report cyber incidents to inform cyber defense | Task | Partial | CCI, DF, IR | Incident Response: Phase 4: Post-Incident Activity |
| T5041 | Prepare cyber defense toolkits | Task | Partial | DF | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| T5042 | Analyze material from cybersecurity incidents for evidence of hostile foreign actor or criminal activity | Task | Partial | CCI | Threat Hunting: Methodology-Based Hunting |
| T5043 | Preserve digital evidence | Task | Covered | CCI | Forensics Evidence Collection: What is Digital Forensics? |
| T5045 | Conduct log file analysis | Task | Covered | DF | Active Directory Attack and Defense: Lab 1.1.1: Analyzing AD Authentication Traffic |
| T5046 | Identify responsible parties for intrusions and other crimes | Task | Partial | CCI | Threat Hunting: Methodology-Based Hunting |
| T5047 | Document original condition of digital evidence | Task | Partial | CCI | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| T5049 | Prepare investigative reports | Task | Covered | CCI | Incident Response: Phase 4: Post-Incident Activity |
| T5052 | Review gathered information for validity and relevance to the investigation in line with organizational policies | Task | Partial | MRE | Memory Forensics: Understanding Windows Processes: Exploring Memory, Threads, and Processes Relationships |
| T5057 | Document lessons learned during events and exercises | Task | Covered | CCI, DA, DF, IR, MRE | Incident Response: Phase 4: Post-Incident Activity |
| T5058 | Identify potential malicious activity from memory dumps, logs and packet captures | Task | Covered | MRE | Memory Forensics: Understanding Windows Processes: Exploring Memory, Threads, and Processes Relationships |
| T5062 | Identify intrusion via dynamic analysis | Task | Covered | DF | Malware Analysis: Dynamic Analysis |
| T5063 | Set up a forensic workstation | Task | Partial | DF | Forensics Evidence Collection: Mounting Forensic Images: Analysis Tools & Techniques |
| T5064 | Document what is known about intrusions | Task | Covered | DF | Incident Response: Phase 4: Post-Incident Activity |
| T5065 | Analyze intrusions | Task | Covered | DF | Incident Response: Phase 4: Post-Incident Activity |
| T5066 | Coordinate technical support to enterprise-wide cybersecurity defense technicians | Task | Partial | IR | Incident Response: Phase 1: Preparation |
| T5067 | Recommend potential courses of action | Task | Covered | CCI | Incident Response: Remediation/Eradication |
| T5500 | Recommend new or revised security, resilience, and dependability measures | Task | Covered | TH | Incident Response: Remediation/Eradication |
| T5501 | Analyze the results of various systems testing to identify cost-effective improvements that can reduce identified risks | Task | Partial | TH | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T5504 | Enhance incident response plans based on Knowledge about threat actors and activities | Task | Partial | TI | Incident Response: Phase 4: Post-Incident Activity |
| T5505 | Coordinate, validate and manage the organization's cyber threat intelligence sources and feeds | Task | Partial | TI | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T5507 | Prepare and deliver briefs on specific threats to the organization | Task | Partial | TH, TI | Incident Response: Phase 4: Post-Incident Activity |
| T5509 | Conduct network scouting | Task | Partial | TH | Active Directory Attack and Defense: Lab 1.1.3: Analyzing AD Trust Security Configurations - Trust Enumeration and Unconstrained Delegation Abuse |
| T5511 | Detect exploits against targeted networks and hosts | Task | Covered | TH | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T5512 | Determine what technologies are used by a given target | Task | Covered | TH | Disk Forensics: Windows Forensics |
| T5514 | Collect and analyze threat actors data | Task | Partial | TH | Threat Hunting: Methodology-Based Hunting |
| T5515 | Evaluate threat decision-making processes | Task | Partial | TH, TI | Threat Hunting: Methodology-Based Hunting |
| T5517 | Identify organization's principal cyber threats | Task | Partial | TH, TI | Incident Response: Phase 2: Detection & Analysis |
| T5519 | Identify cyber threat tactics and methodologies | Task | Covered | MRE, TH, TI | Threat Hunting: Methodology-Based Hunting |
| T5520 | Identify vulnerabilities | Task | Covered | TH | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T5523 | Develop courses of action based on threat factors | Task | Covered | TH | Threat Hunting: Methodology-Based Hunting |
| T5525 | Monitor threat activities | Task | Partial | MRE, TH, TI | Threat Hunting: Threat Hunting Essentials |
| T5527 | Monitor and report threat actor activities | Task | Partial | TI | Threat Hunting: Threat Hunting Essentials |
| T5530 | Provide intelligence analysis and support | Task | Partial | TI | Threat Hunting: Methodology-Based Hunting |
| T5531 | Prepare network intrusion reports | Task | Covered | TI | Incident Response: Phase 4: Post-Incident Activity |
| T5532 | Perform real-time cyber defense incident handling | Task | Partial | TH | Incident Response: Phase 2: Detection & Analysis |
| T5535 | Maintain a common intelligence picture | Task | Partial | MRE, TI | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| T5537 | Develop priority information requirements | Task | Partial | MRE, TI | Threat Hunting: Methodology-Based Hunting |
| T5539 | Produce timely, fused, all-source cyber operations intelligence and/or indications and warnings intelligence products | Task | Partial | MRE, TI | Threat Hunting: Elastic SIEM |
| T5541 | Recommend adjustments to intelligence collection strategies | Task | Partial | TI | Threat Hunting: Threat Hunting Essentials |
| T5543 | Determine effectiveness of intelligence collection operations | Task | Partial | TI | Threat Hunting: Threat Hunting Essentials |
| T5547 | Prepare threat activity reports | Task | Partial | MRE, TH, TI | Incident Response: Phase 4: Post-Incident Activity |
| T5548 | Manage collection requirements | Task | Partial | TI | Threat Hunting: Methodology-Based Hunting |
| K0001 | Knowledge of network components and operations | Knowledge | Covered | CCI, CS, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Network Forensics: Extracting IoCs & Objects |
| K0002 | Knowledge of risk assessment principles and practices | Knowledge | Partial | CCI, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0003 | Knowledge of cybersecurity laws and regulations | Knowledge | Partial | CCI, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Security Operations Fundamentals: SOC Components: Processes |
| K0004 | Knowledge of cybersecurity principles and practices | Knowledge | Covered | CCI, CS, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Incident Response: Phase 1: Preparation |
| K0005 | Knowledge of cybersecurity threats | Knowledge | Covered | CCI, CS, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Perimeter Defense - Email Security: Email Spoofing |
| K0007 | Knowledge of authentication and authorization tools and techniques | Knowledge | Covered | CS, DA, IAM | Active Directory Attack and Defense: Lab 1.1.1: Analyzing AD Authentication Traffic |
| K0009 | Knowledge of common application vulnerabilities | Knowledge | Covered | CS, VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0013 | Knowledge of cyber defense tools and techniques | Knowledge | Covered | CS, DA, IAM, TH | Incident Response: Phase 1: Preparation |
| K0014 | Knowledge of computer algorithm capabilities and applications | Knowledge | Partial | CS, DA, MRE, TH | Malware Analysis: Static Analysis |
| K0016 | Knowledge of encryption algorithm capabilities and applications | Knowledge | Partial | DA, DF, MRE, TH | Perimeter Defense - Email Security: Email Spoofing |
| K0017 | Knowledge of cryptography principles and practices | Knowledge | Partial | CS, DA, INF, VA | Perimeter Defense - Email Security: Email Spoofing |
| K0019 | Knowledge of data backup and recovery policies and procedures | Knowledge | Partial | CS, DF, INF, IR, VA | Incident Response: Restore, Validate, and Monitor |
| K0020 | Knowledge of database systems and software | Knowledge | Partial | CS, DA | Threat Hunting: Elastic SIEM |
| K0021 | Knowledge of business continuity and disaster recovery (BCDR) policies and procedures | Knowledge | Partial | IR | Incident Response: Restore, Validate, and Monitor |
| K0024 | Knowledge of host access control (HAC) systems and software | Knowledge | Covered | CS, DA, IAM, INF, IR, VA | Active Directory Attack and Defense: Lab 1.2.5: Identifying Credential Dumping Indicators |
| K0025 | Knowledge of network communications principles and practices | Knowledge | Covered | IR | Network Forensics: Extracting IoCs & Objects |
| K0028 | Knowledge of cybersecurity assessment and authorization processes | Knowledge | Partial | IAM, TH | Security Operations Fundamentals: SOC Components: Processes |
| K0031 | Knowledge of information sources for identifying and effectively addressing vulnerabilities | Knowledge | Covered | CS, DA, TH | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0032 | Knowledge of incident response principles and practices | Knowledge | Covered | IR, TH | Incident Response: Phase 1: Preparation |
| K0034 | Knowledge of methods to conduct best practice analysis | Knowledge | Covered | TH | Security Operations Fundamentals: SOC Components: Processes |
| K0035 | Knowledge of Confidentiality, Integrity and Availability (CIA) principles and practices | Knowledge | Covered | CS, DA, IAM, INF, TH, VA | Security Operations Fundamentals: Security Operations Fundamentals |
| K0042 | Knowledge of identity and access management (IAM) principles and practices | Knowledge | Covered | DA, IAM, VA | Active Directory Attack and Defense: Lab 1.1.1: Analyzing AD Authentication Traffic |
| K0043 | Knowledge of network traffic analysis tools and techniques | Knowledge | Covered | CS, DA, INF, IR, MRE, TH, TI | Network Forensics: Understanding Network Data Sources |
| K0044 | Knowledge of new and emerging technologies, as they relate to cybersecurity | Knowledge | Partial | DA, TH | Threat Hunting: Threat Hunting Essentials |
| K0045 | Knowledge of operating system (OS) principles | Knowledge | Covered | CS, DA, DF | Disk Forensics: Windows Forensics |
| K0046 | Knowledge of network traffic protocols | Knowledge | Covered | DA, INF, VA | Network Forensics: Extracting IoCs & Objects |
| K0047 | Knowledge of packet-level analysis tools and techniques | Knowledge | Covered | IR, MRE, TH | Network Forensics: Understanding Network Data Sources |
| K0049 | Knowledge of policy-based access controls | Knowledge | Covered | DA, IAM | Active Directory Attack and Defense: Lab 1.2.5: Identifying Credential Dumping Indicators |
| K0051 | Knowledge of programming language structures and logic | Knowledge | Covered | CS, VA | Malware Analysis: MS Office Documents Analysis |
| K0053 | Knowledge of cybersecurity management principles and practices | Knowledge | Partial | CS, DA | Security Operations Fundamentals: Security Operations Fundamentals |
| K0058 | Knowledge of telecommunications principles and practices | Knowledge | Partial | DA | Network Forensics: Understanding Network Data Types |
| K0059 | Knowledge of data management tools and techniques | Knowledge | Covered | IAM | Threat Hunting: Elastic SIEM |
| K0064 | Knowledge of network attack characteristics | Knowledge | Covered | DA, INF, IR, TH, VA | Network Forensics: Extracting IoCs & Objects |
| K0066 | Knowledge of computer physical components | Knowledge | Partial | DF, TI | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| K0068 | Knowledge of network tools and techniques | Knowledge | Covered | CS, DA, TH | Network Forensics: Extracting IoCs & Objects |
| K0069 | Knowledge of defense-in-depth principles and practices | Knowledge | Covered | DA | Incident Response: Phase 1: Preparation |
| K0070 | Knowledge of network communication types | Knowledge | Partial | DA | Network Forensics: Extracting IoCs & Objects |
| K0072 | Knowledge of file extensions | Knowledge | Covered | DA | Perimeter Defense - Email Security: Malicious Attachments |
| K0075 | Knowledge of digital forensics data characteristics | Knowledge | Covered | DF | Forensics Evidence Collection: What is Digital Forensics? |
| K0076 | Knowledge of interpreted and compiled computer languages | Knowledge | Partial | DA, VA | Malware Analysis: MS Office Documents Analysis |
| K0077 | Knowledge of threat intelligence sources, capabilities and limitations | Knowledge | Covered | DA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0078 | Knowledge of how threat intelligence sources collect intelligence | Knowledge | Partial | DA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0084 | Knowledge of cybersecurity policies and procedures | Knowledge | Covered | CS, DA, INF, IR | Security Operations Fundamentals: SOC Components: Processes |
| K0085 | Knowledge of the organization's IT user security policies | Knowledge | Partial | IAM | Security Operations Fundamentals: SOC Components: Processes |
| K0086 | Knowledge of network attack vectors | Knowledge | Covered | DA, TH | Network Forensics: Extracting IoCs & Objects |
| K0087 | Knowledge of cyberattack characteristics | Knowledge | Covered | DA, IR, VA | Perimeter Defense - Email Security: Email Spoofing |
| K0088 | Knowledge of cyberattack actor characteristics | Knowledge | Covered | DA, IR, TH, VA | Threat Hunting: Methodology-Based Hunting |
| K0090 | Knowledge of system administration, network management and operating system hardening methods | Knowledge | Covered | DA, DF, IR, VA | Perimeter Defense - Email Security: Extra Mile Controls |
| K0096 | Knowledge of networking protocols | Knowledge | Covered | MRE | Network Forensics: Extracting IoCs & Objects |
| K0097 | Knowledge of software reverse engineering tools and techniques | Knowledge | Covered | MRE | Malware Analysis: Static Analysis |
| K0098 | Knowledge of Extensible Markup Language (XML) schemas | Knowledge | Partial | MRE | Active Directory Attack and Defense: Lab 1.1.2: SAML Authentication and Silver SAML in Entra ID (2) |
| K0099 | Knowledge of the stages of a cyberattack | Knowledge | Covered | DA, IR, MRE, TI, VA | Threat Hunting: Methodology-Based Hunting |
| K0100 | Knowledge of network architecture principles and practices | Knowledge | Covered | DA, DF, INF, IR, MRE, VA | Incident Response: Phase 1: Preparation |
| K0101 | Knowledge of network systems management principles and practices | Knowledge | Partial | DA, MRE | Threat Hunting: Elastic SIEM |
| K0102 | Knowledge of encryption tools and techniques | Knowledge | Covered | DA, MRE | Network Forensics: Understanding Network Data Sources |
| K0103 | Knowledge of malware signature principles and practices | Knowledge | Covered | DA, MRE | Malware Analysis: Static Analysis |
| K0104 | Knowledge of Windows ports and services | Knowledge | Covered | CS, DA, INF, MRE | Network Forensics: Extracting IoCs & Objects |
| K0105 | Knowledge of data remediation tools and techniques | Knowledge | Partial | MRE | Incident Response: Restore, Validate, and Monitor |
| K0106 | Knowledge of cloud computing principles and practices | Knowledge | Covered | IAM | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0112 | Knowledge of application firewall principles and practices | Knowledge | Covered | IAM | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0113 | Knowledge of industry cybersecurity standards and frameworks | Knowledge | Covered | DA, VA | Security Operations Fundamentals: SOC Components: Processes |
| K0117 | Knowledge of the Open Systems Interconnect (OSI) reference model | Knowledge | Partial | DA, IR | Network Forensics: Understanding Network Data Sources |
| K0119 | Knowledge of operating system administration principles and practices | Knowledge | Partial | CS, DF, INF, VA | Active Directory Attack and Defense: Lab 1.2.3: Identifying AD Attack Patterns in Event Logs |
| K0121 | Knowledge of cloud service models and frameworks | Knowledge | Covered | IR | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0123 | Knowledge of malware analysis principles and practices | Knowledge | Covered | IR | Malware Analysis: Static Analysis |
| K0124 | Knowledge of Personally Identifiable Information (PII) data security standards and best practices | Knowledge | Partial | DA, IAM | Security Operations Fundamentals: SOC Components: Processes |
| K0125 | Knowledge of Payment Card Industry (PCI) data security standards and best practices | Knowledge | Partial | DA, IAM | Security Operations Fundamentals: SOC Components: Processes |
| K0126 | Knowledge of data security standards relating to the sector in which the organization operates | Knowledge | Partial | DA, IAM | Security Operations Fundamentals: SOC Components: Processes |
| K0134 | Knowledge of cybersecurity system testing tools and techniques | Knowledge | Covered | DA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0136 | Knowledge of countermeasure design principles and practices | Knowledge | Covered | DA | Incident Response: Remediation/Eradication |
| K0137 | Knowledge of network mapping principles and practices | Knowledge | Partial | DA | Network Forensics: Extracting IoCs & Objects |
| K0144 | Knowledge of cybersecurity information sharing principles and practices | Knowledge | Covered | IAM | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0145 | Knowledge of command-line tools and techniques | Knowledge | Covered | DA | Network Forensics: Understanding Network Data Sources |
| K0147 | Knowledge of Intrusion Detection System (IDS) tools and techniques | Knowledge | Covered | DA, INF | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0153 | Knowledge of penetration testing principles and practices | Knowledge | Partial | DA, VA | Active Directory Attack and Defense: Lab 1.1.4: Analyzing AD Trust Security Configurations - GPO Abuse at the Site Level |
| K0159 | Knowledge of operations security (OPSEC) principles and practices | Knowledge | Covered | CS, DA, INF, IR, TI | Network Forensics: Extracting IoCs & Objects |
| K0169 | Knowledge of data compromise reporting policies and procedures | Knowledge | Partial | IR | Incident Response: Phase 1: Preparation |
| K0170 | Knowledge of hexadecimal data | Knowledge | Covered | CCI, MRE | Malware Analysis: Static Analysis |
| K0171 | Knowledge of code analysis tools and techniques | Knowledge | Covered | CCI, CS, DF, IR, MRE | Malware Analysis: Static Analysis |
| K0175 | Knowledge of network firewall principles and practices | Knowledge | Covered | IAM | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0176 | Knowledge of encryption algorithms | Knowledge | Partial | DA, DF, MRE, TH | Perimeter Defense - Email Security: Email Spoofing |
| K0177 | Knowledge of network configurations | Knowledge | Covered | DA, INF, TI | Disk Forensics: Collecting Network connections, and devices |
| K0184 | Knowledge of security orchestration, automation, and response (SOAR) tools and techniques | Knowledge | Covered | CS, DA, INF, IR, TI, VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0186 | Knowledge of cybersecurity controls | Knowledge | Covered | CCI, CS, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Incident Response: Phase 1: Preparation |
| K0187 | Knowledge of risk mitigation principles and practices | Knowledge | Covered | CCI, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Incident Response: Remediation/Eradication |
| K0188 | Knowledge of data protection principles and practices | Knowledge | Covered | CCI, CS, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Forensics Evidence Collection: What is Digital Forensics? |
| K0189 | Knowledge of cybersecurity vulnerabilities | Knowledge | Covered | CCI, CS, DA, DF, IAM, INF, IR, MRE, TH, TI, VA | Perimeter Defense - Email Security: Email Spoofing |
| K0190 | Knowledge of access control methods | Knowledge | Covered | CS, DA, IAM | Active Directory Attack and Defense: Lab 1.1.1: Analyzing AD Authentication Traffic |
| K0191 | Knowledge of vulnerability assessment tools and techniques | Knowledge | Covered | CS, DA, IAM, TH | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0192 | Knowledge of cryptographic key management principles and practices | Knowledge | Partial | CS, DA, INF, VA | Perimeter Defense - Email Security: Email Spoofing |
| K0194 | Knowledge of network access control (NAC) systems and software | Knowledge | Partial | CS, DA, IAM, INF, IR, VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0195 | Knowledge of incident response policies and procedures | Knowledge | Covered | IR, TH | Incident Response: Phase 1: Preparation |
| K0196 | Knowledge of incident response tools and techniques | Knowledge | Covered | IR, TH | Incident Response: Phase 1: Preparation |
| K0197 | Knowledge of Risk Adaptive (Adaptable) Access Controls (RAdAC) | Knowledge | Covered | DA, IAM | Active Directory Attack and Defense: Lab 1.2.6: Identifying Cloud Credential Abuse |
| K0198 | Knowledge of insider threat tools and techniques | Knowledge | Partial | CCI, DA, TH | Forensics Evidence Collection: What is Digital Forensics? |
| K0199 | Knowledge of insider threat operational indicators | Knowledge | Partial | CCI, DA, TH | Forensics Evidence Collection: What is Digital Forensics? |
| K0201 | Knowledge of insider threat tactics | Knowledge | Partial | CCI, DA, TH | Forensics Evidence Collection: What is Digital Forensics? |
| K0202 | Knowledge of insider threat targets | Knowledge | Partial | CCI, DA, TH | Forensics Evidence Collection: What is Digital Forensics? |
| K0203 | Knowledge of computer peripherals | Knowledge | Partial | DF, TI | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| K0205 | Knowledge of network cybersecurity principles and practices | Knowledge | Covered | DA, DF, INF, IR, MRE, VA | Incident Response: Phase 1: Preparation |
| K0206 | Knowledge of Unix ports and services | Knowledge | Partial | CS, DA, INF, MRE | Network Forensics: Understanding Network Data Sources |
| K0207 | Knowledge of Knowledge management principles and practices | Knowledge | Partial | IAM | Incident Response: Incident Response Overiew |
| K0208 | Knowledge of Knowledge management tools and techniques | Knowledge | Partial | IAM | Incident Response: Incident Response Overiew |
| K0211 | Knowledge of cybersecurity information sharing tools and techniques | Knowledge | Covered | IAM | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0212 | Knowledge of Intrusion Prevention System (IPS) tools and techniques | Knowledge | Covered | DA, INF | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K0213 | Knowledge of penetration testing tools and techniques | Knowledge | Partial | DA, VA | Active Directory Attack and Defense: Lab 1.1.4: Analyzing AD Trust Security Configurations - GPO Abuse at the Site Level |
| K0214 | Knowledge of red team functions and capabilities | Knowledge | Partial | DA, VA | Incident Response: Phase 2: Detection & Analysis |
| K0519 | Knowledge of system backup requirements | Knowledge | Partial | INF | Incident Response: Restore, Validate, and Monitor |
| K1052 | Knowledge of data storage principles and practices | Knowledge | Covered | INF | Forensics Evidence Collection: What is Digital Forensics? |
| K1503 | Knowledge of client and server architecture | Knowledge | Covered | DF | Incident Response: Phase 2: Detection & Analysis |
| K3506 | Knowledge of protocol analyzer tools and techniques | Knowledge | Covered | DA | Network Forensics: Understanding Network Data Sources |
| K3507 | Knowledge of organizational cybersecurity incident response plans | Knowledge | Covered | DA, IR | Incident Response: Phase 1: Preparation |
| K3508 | Knowledge of ransomware defense tools and techniques | Knowledge | Partial | DA | Malware Analysis: Dynamic Analysis |
| K4000 | Knowledge of remote access principles and practices | Knowledge | Covered | IAM | Incident Response: Incident Response Overiew |
| K4001 | Knowledge of the capabilities and functionality associated with content creation technologies | Knowledge | Partial | IAM | Malware Analysis: MS Office Documents Analysis |
| K4002 | Knowledge of the capabilities and functionality of collaborative technologies and their implications for cybersecurity | Knowledge | Partial | IAM | Incident Response: Phase 1: Preparation |
| K4016 | Knowledge of reporting policies and procedures | Knowledge | Partial | IAM | Incident Response: Phase 1: Preparation |
| K4021 | Knowledge of Attribute-Based Access Control (ABAC) principles and practices | Knowledge | Partial | IAM | Active Directory Attack and Defense: Lab 1.1.7: Analyzing Azure AD External Identity and Trust Security - Cross-Tenant Trust, Conditional Access, and Token-Based Attacks |
| K4022 | Knowledge of Cloud Access Security Broker (CASB) principles and practices | Knowledge | Covered | IAM | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K4023 | Knowledge of Discretionary Access Control (DAC) principles and practices | Knowledge | Partial | IAM | Active Directory Attack and Defense: Lab 1.2.3: Identifying AD Attack Patterns in Event Logs |
| K4024 | Knowledge of Kerberos authentication principles and practices | Knowledge | Covered | IAM | Active Directory Attack and Defense: Lab 1.1.1: Analyzing AD Authentication Traffic |
| K4026 | Knowledge of Role-Based Access Control (RBAC) principles and practices | Knowledge | Partial | IAM | Incident Response: Incident Response Overiew |
| K4028 | Knowledge of Single Sign-On (SSO) principles and practices | Knowledge | Covered | IAM | Active Directory Attack and Defense: Lab 1.1.2: SAML Authentication and Silver SAML in Entra ID (2) |
| K4029 | Knowledge of Single Sign-On (SSO) tools and techniques | Knowledge | Covered | IAM | Active Directory Attack and Defense: Lab 1.1.2: SAML Authentication and Silver SAML in Entra ID (2) |
| K4030 | Knowledge of remote access tools and techniques | Knowledge | Covered | IAM | Incident Response: Incident Response Overiew |
| K4511 | Knowledge of cybersecurity adversarial tactics principles and practices | Knowledge | Covered | IR | Threat Hunting: Methodology-Based Hunting |
| K4512 | Knowledge of cybersecurity adversarial tactics tools and techniques | Knowledge | Partial | IR | Active Directory Attack and Defense: Lab 1.1.4: Analyzing AD Trust Security Configurations - GPO Abuse at the Site Level |
| K4514 | Knowledge of red, blue, and purple teaming principles and practices | Knowledge | Partial | IR, VA | Incident Response: Phase 2: Detection & Analysis |
| K5000 | Knowledge of server diagnostic tools and techniques | Knowledge | Partial | DF | Disk Forensics: Windows Forensics |
| K5001 | Knowledge of the main types of electronic devices and their capabilities | Knowledge | Partial | CCI | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| K5002 | Knowledge of file system implementation principles and practices | Knowledge | Covered | DF | Disk Forensics: Collecting File and Folder Activity |
| K5003 | Knowledge of digital evidence seizure policies and procedures | Knowledge | Partial | CCI, DF | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| K5006 | Knowledge of digital evidence preservation policies and procedures | Knowledge | Partial | CCI, DF | Forensics Evidence Collection: What is Digital Forensics? |
| K5007 | Knowledge of chain of custody policies and procedures | Knowledge | Partial | CCI, DF | Forensics Evidence Collection: What is Digital Forensics? |
| K5008 | Knowledge of persistent data principles and practices | Knowledge | Covered | CCI, DF | Forensics Evidence Collection: What is Digital Forensics? |
| K5009 | Knowledge of web mail tools and techniques | Knowledge | Partial | DF | Perimeter Defense - Email Security: Responding to Email Attacks |
| K5010 | Knowledge of system file characteristics | Knowledge | Covered | DF | Forensics Evidence Collection: What is Digital Forensics? |
| K5011 | Knowledge of deployable forensics principles and practices | Knowledge | Covered | DF | Forensics Evidence Collection: Memory Acquisition |
| K5012 | Knowledge of web filtering systems and software | Knowledge | Covered | INF | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K5014 | Knowledge of event correlation tools and techniques | Knowledge | Covered | DF | Threat Hunting: Elastic SIEM |
| K5015 | Knowledge of electronic evidence laws and regulations | Knowledge | Partial | CCI, DF | Forensics Evidence Collection: What is Digital Forensics? |
| K5017 | Knowledge of data carving tools and techniques | Knowledge | Covered | DF, MRE | Network Forensics: Extracting IoCs & Objects |
| K5019 | Knowledge of anti-forensics tools and techniques | Knowledge | Covered | DF, MRE | Memory Forensics: Understanding Windows Processes: Exploring Memory, Threads, and Processes Relationships |
| K5020 | Knowledge of forensics lab design principles and practices | Knowledge | Partial | DF, MRE | Forensics Evidence Collection: Mounting Forensic Images: Analysis Tools & Techniques |
| K5021 | Knowledge of debugging tools and techniques | Knowledge | Covered | DF, MRE | Malware Analysis: Static Analysis |
| K5022 | Knowledge of filename extension abuse | Knowledge | Covered | DF, MRE | Network Forensics: Extracting IoCs & Objects |
| K5023 | Knowledge of malware analysis tools and techniques | Knowledge | Covered | DF, MRE | Malware Analysis: Static Analysis |
| K5025 | Knowledge of crisis management protocols | Knowledge | Partial | CCI | Incident Response: Phase 1: Preparation |
| K5028 | Knowledge of binary analysis tools and techniques | Knowledge | Covered | DF | Malware Analysis: Static Analysis |
| K5031 | Knowledge of operational design principles and practices | Knowledge | Partial | DF | Threat Hunting: Threat Hunting Essentials |
| K5033 | Knowledge of digital forensics tools and techniques | Knowledge | Covered | CCI, DF | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| K5034 | Knowledge of data integrity principles and practices | Knowledge | Covered | CCI, DF | Forensics Evidence Collection: What is Digital Forensics? |
| K5037 | Knowledge of chain of custody processes | Knowledge | Partial | DF | Forensics Evidence Collection: What is Digital Forensics? |
| K5039 | Knowledge of deployable forensics tools and techniques | Knowledge | Covered | DF | Forensics Evidence Collection: Memory Acquisition |
| K5040 | Knowledge of forensics lab design systems and software | Knowledge | Partial | DF, MRE | Forensics Evidence Collection: Mounting Forensic Images: Analysis Tools & Techniques |
| K5041 | Knowledge of crisis management processes | Knowledge | Partial | CCI | Incident Response: Phase 1: Preparation |
| K5042 | Knowledge of crisis management tools and techniques | Knowledge | Partial | CCI | Incident Response: Phase 1: Preparation |
| K5502 | Knowledge of cyberattack tools and techniques | Knowledge | Covered | TI | Threat Hunting: Methodology-Based Hunting |
| K5505 | Knowledge of computer networking principles and practices | Knowledge | Covered | TH, TI | Network Forensics: Extracting IoCs & Objects |
| K5510 | Knowledge of cyber operations principles and practices | Knowledge | Partial | TH, TI | Threat Hunting: Threat Hunting Essentials |
| K5511 | Knowledge of host-based security products and their capabilities | Knowledge | Covered | TI | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K5513 | Knowledge of electronic communication systems threats and risks | Knowledge | Covered | TI | Perimeter Defense - Email Security: Email Spoofing |
| K5516 | Knowledge of different types of organization, team and people involved in cyber threat intelligence collection | Knowledge | Partial | TI | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K5519 | Knowledge of the tactics an organization can employ to anticipate and counter an attacker's capabilities and actions | Knowledge | Covered | TH, TI | Threat Hunting: Methodology-Based Hunting |
| K5520 | Knowledge of network addressing principles and practices | Knowledge | Partial | TI | Network Forensics: Understanding Network Data Types |
| K5521 | Knowledge of cyber threat actors | Knowledge | Covered | TH | Threat Hunting: Methodology-Based Hunting |
| K5522 | Knowledge of performing threat environment analysis | Knowledge | Covered | TH | Threat Hunting: Methodology-Based Hunting |
| K5523 | Knowledge of malware | Knowledge | Covered | TI | Perimeter Defense - Email Security: Email Spoofing |
| K5524 | Knowledge of cyber decision-making policies and procedures | Knowledge | Partial | TI | Incident Response: Phase 1: Preparation |
| K5525 | Knowledge of cyber threat actors functions and capabilities | Knowledge | Covered | TH | Threat Hunting: Methodology-Based Hunting |
| K5526 | Knowledge of cyber threat actors tools and techniques | Knowledge | Covered | TH | Threat Hunting: Methodology-Based Hunting |
| K5529 | Knowledge of the factors of threat that could impact collection operations | Knowledge | Partial | TH, TI | Threat Hunting: Threat Hunting Essentials |
| K5531 | Knowledge of threat systems and software | Knowledge | Covered | TH, TI | Malware Analysis: MS Office Documents Analysis |
| K5532 | Knowledge of machine virtualization tools and techniques | Knowledge | Partial | TI | Forensics Evidence Collection: Mounting Forensic Images: Analysis Tools & Techniques |
| K5535 | Knowledge of denial and deception tools and techniques | Knowledge | Covered | TH, TI | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| K5536 | Knowledge of analytical tools and techniques | Knowledge | Covered | CS, TI | Threat Hunting: Methodology-Based Hunting |
| K5537 | Knowledge of threat hunting principles and practices | Knowledge | Covered | TH | Threat Hunting: Methodology-Based Hunting |
| S0001 | Skill in conducting vulnerability scans | Skill | Covered | CS, DA, INF, MRE, TH, VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S0002 | Skill in identifying malware | Skill | Covered | CS, IR | Malware Analysis: Static Analysis |
| S0004 | Skill in applying core cybersecurity principles | Skill | Partial | IR | Incident Response: Phase 1: Preparation |
| S0005 | Skill in applying host access controls | Skill | Covered | IAM, INF | Active Directory Attack and Defense: Lab 1.1.7: Analyzing Azure AD External Identity and Trust Security - Cross-Tenant Trust, Conditional Access, and Token-Based Attacks |
| S0006 | Skill in developing digital signatures | Skill | Covered | DA, IR | Perimeter Defense - Email Security: Email Spoofing |
| S0008 | Skill in designing the integration of hardware and software solutions | Skill | Partial | INF | Incident Response: Phase 1: Preparation |
| S0009 | Skill in detecting host-based and network-based intrusions | Skill | Covered | CS, DA, INF, IR, VA | Active Directory Attack and Defense: Lab 1.2.3: Identifying AD Attack Patterns in Event Logs |
| S0011 | Skill in developing network infrastructure contingency and recovery plans | Skill | Partial | IR | Incident Response: Restore, Validate, and Monitor |
| S0012 | Skill in evaluating cybersecurity system designs | Skill | Partial | CS, DA, IR | Incident Response: Phase 1: Preparation |
| S0013 | Skill in preserving digital evidence integrity | Skill | Covered | CCI, DF, IR | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| S0014 | Skill in configuring network sensors | Skill | Covered | INF, IR | Incident Response: Phase 2: Detection & Analysis |
| S0015 | Skill in using protocol analyzer tools | Skill | Covered | DA, IR | Network Forensics: Understanding Network Data Sources |
| S0016 | Skill in configuring encrypted network communications | Skill | Partial | INF | Network Forensics: Understanding Network Data Sources |
| S0018 | Skill in solving problems | Skill | Covered | CCI, IR | Threat Hunting: Methodology-Based Hunting |
| S0020 | Skill in performing digital forensics analysis | Skill | Covered | DF, IR | Disk Forensics: Collecting File and Folder Activity |
| S0021 | Skill in configuring and utilizing computer protection tools | Skill | Covered | CS, INF | Incident Response: Phase 2: Detection & Analysis |
| S0022 | Skill in securing network communications | Skill | Partial | CS, INF, IR | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S0023 | Skill in categorizing types of vulnerabilities | Skill | Covered | CS, DA, IR | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S0025 | Skill in performing damage assessments | Skill | Covered | IR | Incident Response: Incident Response Overiew |
| S0026 | Skill in performing network data analysis | Skill | Covered | IR, VA | Network Forensics: Preparing Network Captures for Network Analysis |
| S0027 | Skill in configuring network protection components | Skill | Partial | CS, IR | Incident Response: Phase 2: Detection & Analysis |
| S0028 | Skill in conducting cybersecurity audits or reviews of technical systems | Skill | Covered | CS | Security Operations Fundamentals: SOC Components: Processes |
| S0029 | Skill in using binary analysis tools | Skill | Covered | DF, MRE, TH | Malware Analysis: Static Analysis |
| S0030 | Skill in implementing one-way hash functions | Skill | Partial | DF, MRE, TH | Malware Analysis: Static Analysis |
| S0031 | Skill in reading Hexadecimal data | Skill | Covered | MRE, TH | Malware Analysis: Static Analysis |
| S0032 | Skill in identifying common encoding techniques | Skill | Covered | MRE, TH | Malware Analysis: Static Analysis |
| S0033 | Skill in reading digital signatures | Skill | Partial | DA, IR | Perimeter Defense - Email Security: Email Spoofing |
| S0035 | Skill in applying hardening techniques | Skill | Covered | CS, INF, IR | Active Directory Attack and Defense: Lab 1.2.5: Identifying Credential Dumping Indicators |
| S0037 | Skill in conducting application vulnerability assessments | Skill | Covered | VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S0038 | Skill in implementing public key infrastructure (PKI) encryption | Skill | Partial | INF | Perimeter Defense - Email Security: Email Spoofing |
| S0040 | Skill in assessing cybersecurity controls | Skill | Covered | DA, INF | Security Operations Fundamentals: SOC Components: Processes |
| S0041 | Skill in performing packet-level analysis | Skill | Covered | DA, DF, IR | Network Forensics: Understanding Network Data Sources |
| S0044 | Skill in performing risk assessments | Skill | Partial | IR, VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S0046 | Skill in performing event correlation | Skill | Covered | DA, IR | Active Directory Attack and Defense: Lab 1.2.3: Identifying AD Attack Patterns in Event Logs |
| S0048 | Skill in performing root cause analysis | Skill | Covered | DA, IR, MRE | Incident Response: Remediation/Eradication |
| S0050 | Skill in performing target system analysis | Skill | Covered | TH | Disk Forensics: Windows Forensics |
| S0051 | Skill in preparing briefings | Skill | Partial | IR, TH, TI | Incident Response: Phase 4: Post-Incident Activity |
| S0052 | Skill in recognizing abnormal network activity in traffic | Skill | Covered | IR, MRE, TH | Network Forensics: Preparing Network Captures for Network Analysis |
| S0053 | Skill in performing reverse engineering of software | Skill | Partial | MRE, TH | Malware Analysis: Static Analysis |
| S0054 | Skill in analyzing tools, techniques, and procedures used by adversaries remotely to exploit and establish persistence on a target | Skill | Covered | IR | Active Directory Attack and Defense: Lab 1.2.3: Identifying AD Attack Patterns in Event Logs |
| S0055 | Skill in incorporating feedback | Skill | Partial | TI | Incident Response: Phase 4: Post-Incident Activity |
| S0056 | Skill in performing threat analysis | Skill | Covered | DA, TH, TI, VA | Active Directory Attack and Defense: Lab 1.2.3: Identifying AD Attack Patterns in Event Logs |
| S0057 | Skill in bridging the gap between threat intelligence and strategy effectiveness | Skill | Partial | DA | Threat Hunting: Methodology-Based Hunting |
| S0058 | Skill in communicating effectively | Skill | Partial | TI | Incident Response: Phase 4: Post-Incident Activity |
| S0059 | Skill in identifying cybersecurity threats | Skill | Covered | TH | Active Directory Attack and Defense: Lab 1.2.3: Identifying AD Attack Patterns in Event Logs |
| S0060 | Skill in responding effectively to cyber incidents in cloud environment | Skill | Covered | IR | Active Directory Attack and Defense: Lab 1.2.4: Identifying Cloud Attack Patterns in Azure/Entra ID |
| S0061 | Skill in applying confidentiality, integrity, and availability (CIA) principles | Skill | Partial | DA, IAM, INF, VA | Incident Response: Phase 1: Preparation |
| S0062 | Skill in using risk management techniques | Skill | Partial | CS, TH | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S0063 | Skill in utilizing cyber defense service providers | Skill | Partial | DA | Security Operations Fundamentals: Security Operations Fundamentals |
| S0065 | Skill in designing cyber processes and solutions | Skill | Partial | INF | Incident Response: Phase 1: Preparation |
| S0066 | Skill in high-level programming | Skill | Partial | MRE | Malware Analysis: MS Office Documents Analysis |
| S0068 | Skill in analyzing software configurations | Skill | Covered | CCI, CS, DF, INF, IR, MRE, TH, VA | Disk Forensics: Windows Forensics |
| S0069 | Skill in performing network data flow analysis | Skill | Covered | CCI, DA, DF, INF, TH | Network Forensics: Understanding Network Data Types |
| S0070 | Skill in identifying cybersecurity related coding flaws | Skill | Partial | TH | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S0071 | Skill in designing secure network architectures | Skill | Partial | INF | Incident Response: Phase 1: Preparation |
| S0076 | Skill in mitigating deception in reporting and analysis | Skill | Partial | TH, TI | Memory Forensics: Understanding Windows Processes: Exploring Memory, Threads, and Processes Relationships |
| S0077 | Skill in applying critical thinking | Skill | Covered | MRE, TH, TI | Threat Hunting: Methodology-Based Hunting |
| S0082 | Skill in identifying critical information systems | Skill | Covered | INF | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S0083 | Skill in installing system and component upgrades | Skill | Partial | CS | Incident Response: Restore, Validate, and Monitor |
| S0084 | Skill in optimizing system performance | Skill | Partial | CS | Incident Response: Restore, Validate, and Monitor |
| S0085 | Skill in testing backup and recovery plans | Skill | Partial | CS, DF, INF, IR, VA | Incident Response: Restore, Validate, and Monitor |
| S0086 | Skill in communicating cybersecurity concepts and practices effectively | Skill | Partial | TI | Incident Response: Phase 4: Post-Incident Activity |
| S0092 | Skill in identifying vulnerabilities in security systems | Skill | Covered | CS, DA, INF, MRE, TH, VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S0093 | Skill in capturing malware | Skill | Covered | CS, IR | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| S0094 | Skill in containing malware | Skill | Covered | CS, IR | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| S0095 | Skill in reporting malware | Skill | Partial | CS, IR | Malware Analysis: Static Analysis |
| S0096 | Skill in applying network access controls | Skill | Partial | IAM, INF | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S0097 | Skill in deploying digital signatures | Skill | Covered | DA, IR | Perimeter Defense - Email Security: Email Spoofing |
| S0098 | Skill in testing network infrastructure contingency and recovery plans | Skill | Partial | DF, IR | Incident Response: Restore, Validate, and Monitor |
| S0099 | Skill in implementing network infrastructure contingency and recovery plans | Skill | Partial | DF, IR | Incident Response: Restore, Validate, and Monitor |
| S0100 | Skill in using one-way hash functions | Skill | Covered | DF, MRE, TH | Forensics Evidence Collection: What is Digital Forensics? |
| S0101 | Skill in interpreting digital signatures | Skill | Partial | DA, IR | Perimeter Defense - Email Security: Email Spoofing |
| S0102 | Skill in reading application vulnerability assessment reports | Skill | Covered | VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S0103 | Skill in presenting to an audience | Skill | Partial | IR, TH, TI | Incident Response: Phase 4: Post-Incident Activity |
| S0104 | Skill in interpreting abnormal network activity in traffic | Skill | Covered | CS, DA, IR, MRE, TH | Network Forensics: Preparing Network Captures for Network Analysis |
| S0106 | Skill in integrating cyber processes and solutions | Skill | Partial | INF | Incident Response: Phase 1: Preparation |
| S0505 | Skill in translating operational requirements into security controls | Skill | Partial | TI | Incident Response: Phase 2: Detection & Analysis |
| S0506 | Skill in implementing network segregation | Skill | Partial | INF | Incident Response: Phase 1: Preparation |
| S1007 | Skill in developing cybersecurity system controls | Skill | Covered | IAM, INF | Incident Response: Phase 2: Detection & Analysis |
| S1009 | Skill in preparing reports | Skill | Covered | TI | Incident Response: Phase 4: Post-Incident Activity |
| S1020 | Skill in performing data analysis | Skill | Covered | TI | Threat Hunting: Elastic SIEM |
| S1022 | Skill in using outlier identification and removal techniques | Skill | Partial | IR | Network Forensics: Preparing Network Captures for Network Analysis |
| S1023 | Skill in writing computer scripts to automate tasks | Skill | Partial | IR, VA | Malware Analysis: MS Office Documents Analysis |
| S1034 | Skill in designing automated analytics systems | Skill | Partial | IR | Incident Response: Phase 2: Detection & Analysis |
| S1038 | Skill in identifying forensic digital footprints | Skill | Covered | CCI, DF | Disk Forensics: Collecting File and Folder Activity |
| S1039 | Skill in performing static code analysis | Skill | Covered | CCI, DF, MRE | Malware Analysis: MS Office Documents Analysis |
| S1047 | Skill in implementing data storage solutions | Skill | Partial | INF | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| S1052 | Skill in deploying software securely | Skill | Partial | CS | Incident Response: Phase 2: Detection & Analysis |
| S1060 | Skill in developing automated analytics systems | Skill | Partial | IR | Incident Response: Phase 2: Detection & Analysis |
| S1502 | Skill in continually identifying new technologies and their potential impact on cybersecurity requirements | Skill | Partial | TI | Threat Hunting: Threat Hunting Essentials |
| S1504 | Skill in collaborating with internal and external stakeholders | Skill | Partial | IAM, TI | Incident Response: Phase 1: Preparation |
| S1506 | Skill in identifying organization's cybersecurity-related technological challenges | Skill | Partial | DA | Security Operations Fundamentals: Security Operations Fundamentals |
| S1509 | Skill in designing and managing a Security Operations Center (SOC) | Skill | Partial | DA, VA | Security Operations Fundamentals: Security Operations Fundamentals |
| S2002 | Skill in performing network traffic analysis | Skill | Covered | DA, IR | Network Forensics: Preparing Network Captures for Network Analysis |
| S2506 | Skill in reviewing logs | Skill | Covered | IR, VA | Active Directory Attack and Defense: Lab 1.1.1: Analyzing AD Authentication Traffic |
| S2507 | Skill in troubleshooting cyber defense infrastructure anomalies | Skill | Partial | INF | Active Directory Attack and Defense: Lab 1.2.3: Identifying AD Attack Patterns in Event Logs |
| S2517 | Skill in identifying intelligence gaps and limitations | Skill | Partial | TI | Threat Hunting: Methodology-Based Hunting |
| S2523 | Skill in prioritizing information | Skill | Covered | IR | Incident Response: Incident Response Overiew |
| S2525 | Skill in interpreting and evaluating metadata | Skill | Covered | TH | Disk Forensics: Collecting File and Folder Activity |
| S2527 | Skill in interpreting vulnerability scanner results | Skill | Covered | TH, VA | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S2533 | Skill in analyzing reports and recommending actions to be taken | Skill | Covered | IR | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| S2537 | Skill in performing intelligence collection analysis | Skill | Partial | TI | Threat Hunting: Methodology-Based Hunting |
| S2542 | Skill in reviewing corporate strategies or applicable legal, regulatory or policy documents to identify issues requiring clarification or action | Skill | Partial | TI | Security Operations Fundamentals: SOC Components: Processes |
| S2543 | Skill in developing appropriate and effective requirements to inform selection of cyber threat intelligence sources or monitoring activity | Skill | Partial | DA, TI | Threat Hunting: Methodology-Based Hunting |
| S2550 | Skill in functioning effectively in a dynamic, fast-paced environment | Skill | Partial | TI | Incident Response: Incident Response Overiew |
| S2552 | Skill in mitigating cognitive biases | Skill | Partial | TI | Memory Forensics: Understanding Windows Processes: Exploring Memory, Threads, and Processes Relationships |
| S2554 | Skill in performing big data analysis | Skill | Partial | TI | Threat Hunting: Elastic SIEM |
| S2557 | Skill in identifying evidence of past intrusions | Skill | Covered | IR, VA | Disk Forensics: Collecting File and Folder Activity |
| S3500 | Skill in using incident handling methodologies | Skill | Covered | DA, INF, IR | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| S3501 | Skill in collecting data from a variety of cybersecurity resources | Skill | Covered | CS, DA, IR, TI | Incident Response: Phase 3: Containment, Eradication, and Recovery |
| S3502 | Skill in conducting trend analysis | Skill | Covered | CS, DA | Threat Hunting: Elastic SIEM |
| S4000 | Skill in conducting information searches | Skill | Covered | IAM | Threat Hunting: Elastic SIEM |
| S4005 | Skill in managing account access rights | Skill | Partial | IAM | Active Directory Attack and Defense: Lab 1.1.7: Analyzing Azure AD External Identity and Trust Security - Cross-Tenant Trust, Conditional Access, and Token-Based Attacks |
| S4006 | Skill in collecting network data | Skill | Covered | CS, DA, INF | Network Forensics: Understanding Network Data Sources |
| S4007 | Skill in deploying user credential management systems | Skill | Partial | IAM | Active Directory Attack and Defense: Lab 1.2.1: Detecting Kerberos-Based Attacks in Event Logs |
| S4008 | Skill in implementing user credential management systems | Skill | Partial | IAM | Active Directory Attack and Defense: Lab 1.2.1: Detecting Kerberos-Based Attacks in Event Logs |
| S4502 | Skill in performing threat modeling | Skill | Partial | MRE, TH, TI, VA | Threat Hunting: Methodology-Based Hunting |
| S4504 | Skill in using penetration testing tools and techniques | Skill | Covered | VA | Active Directory Attack and Defense: Lab 1.1.4: Analyzing AD Trust Security Configurations - GPO Abuse at the Site Level |
| S4505 | Skill in performing social engineering | Skill | Partial | VA | Perimeter Defense - Email Security: Extra Mile Controls |
| S4507 | Skill in assessing an organization's threat environment | Skill | Partial | TH, VA | Threat Hunting: Methodology-Based Hunting |
| S5000 | Skill in performing memory dump analysis | Skill | Covered | DF, IR | Memory Forensics: Understanding Windows Processes: Exploring Memory, Threads, and Processes Relationships |
| S5001 | Skill in identifying forensics data in diverse media | Skill | Covered | DF, IR | Forensics Evidence Collection: What is Digital Forensics? |
| S5002 | Skill in manipulating operating system components | Skill | Partial | DF, IR | Disk Forensics: Linking User Actions to Files/Folders |
| S5003 | Skill in collecting digital evidence | Skill | Covered | CCI, DF, IR | Forensics Evidence Collection: Memory Acquisition |
| S5004 | Skill in setting up a forensic workstation | Skill | Partial | DF, IR | Forensics Evidence Collection: Mounting Forensic Images: Analysis Tools & Techniques |
| S5005 | Skill in using digital forensic tools | Skill | Covered | DF, IR | Disk Forensics: Collecting File and Folder Activity |
| S5006 | Skill in disassembling PCs | Skill | Partial | DF, IR | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| S5008 | Skill in performing source code analysis | Skill | Covered | DF, IR, MRE, TH | Malware Analysis: MS Office Documents Analysis |
| S5009 | Skill in performing volatile data analysis | Skill | Covered | DF, IR, MRE, TH | Memory Forensics: Understanding Windows Processes: Exploring Memory, Threads, and Processes Relationships |
| S5010 | Skill in identifying obfuscation techniques | Skill | Covered | DF, IR, MRE, TH | Malware Analysis: Static Analysis |
| S5011 | Skill in interpreting debugger results | Skill | Covered | DF, IR, MRE, TH | Malware Analysis: MS Office Documents Analysis |
| S5012 | Skill in performing malware analysis | Skill | Covered | DA, DF, IR, MRE, TH | Malware Analysis: Dynamic Analysis |
| S5013 | Skill in performing bit-level analysis | Skill | Partial | DF, IR, MRE | Malware Analysis: Static Analysis |
| S5014 | Skill in processing digital evidence | Skill | Covered | DF, IR, MRE | Forensics Evidence Collection: Memory Acquisition |
| S5018 | Skill in identifying anomalous activity | Skill | Covered | DA, TH | Network Forensics: Preparing Network Captures for Network Analysis |
| S5019 | Skill in performing file system forensic analysis | Skill | Covered | CCI, DF | Disk Forensics: Collecting File and Folder Activity |
| S5020 | Skill in extracting information from packet captures | Skill | Covered | CCI, DF | Network Forensics: Extracting IoCs & Objects |
| S5021 | Skill in performing dynamic analysis | Skill | Covered | CCI, DF | Malware Analysis: Dynamic Analysis |
| S5022 | Skill in decrypting information | Skill | Covered | DF, MRE, TH | Network Forensics: Understanding Network Data Sources |
| S5024 | Skill in examining digital media | Skill | Covered | CCI, DF | Disk Forensics: Collecting File and Folder Activity |
| S5025 | Skill in navigating system files | Skill | Covered | CCI, CS, DF, IAM, IR, MRE, TH, TI, VA | Disk Forensics: Collecting File and Folder Activity |
| S5026 | Skill in identifying filename extension abuse | Skill | Covered | DA, DF | Network Forensics: Extracting IoCs & Objects |
| S5027 | Skill in recognizing digital forensics data | Skill | Covered | DF | Forensics Evidence Collection: What is Digital Forensics? |
| S5028 | Skill in tracing low-level programming | Skill | Partial | MRE | Malware Analysis: Static Analysis |
| S5029 | Skill in using deployable forensics toolkits | Skill | Covered | DF | Forensics Evidence Collection: Memory Acquisition |
| S5030 | Skill in extracting forensics data in diverse media | Skill | Covered | DF, IR | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| S5031 | Skill in performing digital evidence analysis | Skill | Covered | CCI, DF, IR | Disk Forensics: Collecting File and Folder Activity |
| S5032 | Skill in transporting digital evidence | Skill | Partial | CCI, DF, IR | Forensics Evidence Collection: Disk Acquisition: Write-Blocking |
| S5033 | Skill in storing digital evidence | Skill | Covered | CCI, DF, IR | Forensics Evidence Collection: What is Digital Forensics? |
| S5034 | Skill in creating digital evidence copies | Skill | Covered | DF, IR, MRE | Forensics Evidence Collection: What is Digital Forensics? |
| S5501 | Skill in defining an operational environment | Skill | Partial | IR, TI | Threat Hunting: Methodology-Based Hunting |
| S5502 | Skill in developing or recommending analytic approaches in situations where information is incomplete or for which no precedent exists | Skill | Partial | IR, TI | Threat Hunting: Methodology-Based Hunting |
| S5503 | Skill in evaluating potential sources of information for their value to a cyber investigation | Skill | Covered | DA, IR, TH, TI | Threat Hunting: Methodology-Based Hunting |
| S5504 | Skill in evaluating information quality | Skill | Covered | IR, TI | Threat Hunting: Methodology-Based Hunting |
| S5511 | Skill in recognizing network, operating system and application denial of Service (DoS) techniques | Skill | Partial | IR, TH | Security Operations Fundamentals: Security Operations Fundamentals |
| S5515 | Skill in analyzing threat intelligence products | Skill | Covered | TH | Threat Hunting: Methodology-Based Hunting |
| S5516 | Skill in performing data queries | Skill | Covered | TI | Threat Hunting: Elastic SIEM |
| S5517 | Skill in using data analytics tools | Skill | Covered | TI | Threat Hunting: Elastic SIEM |
| S5518 | Skill in conducting open-source searches | Skill | Partial | TI | Malware Analysis: Static Analysis |
| S5519 | Skill in using network analysis and reconstruction tools | Skill | Covered | TH | Network Forensics: Extracting IoCs & Objects |
| S5520 | Skill in using virtual collaborative workspace tools | Skill | Partial | TI | Incident Response: Phase 1: Preparation |
| S5523 | Skill in monitoring threat or vulnerability situation and environmental factors | Skill | Partial | TH | Threat Hunting: Threat Hunting Essentials |
| S5524 | Skill in assessing the implication of cyber attacks on third parties | Skill | Partial | DA, TH | Incident Response: Phase 1: Preparation |
| S5525 | Skill in performing intrusion data analysis | Skill | Covered | DA, TI | Network Forensics: Extracting IoCs & Objects |
| S5526 | Skill in evaluating security products | Skill | Partial | INF | Incident Response: Phase 4: Post-Incident Activity |
| S5527 | Skill in extracting metadata | Skill | Covered | CCI, DF, MRE | Disk Forensics: Collecting File and Folder Activity |
| S5528 | Skill in performing threat emulation tactics | Skill | Covered | TH, TI | Active Directory Attack and Defense: Lab 1.1.4: Analyzing AD Trust Security Configurations - GPO Abuse at the Site Level |
| S5530 | Skill in converting intelligence requirements into intelligence production tasks | Skill | Partial | TI | Threat Hunting: Methodology-Based Hunting |
| S5531 | Skill in thinking like threat actors | Skill | Covered | MRE, TH, TI | Threat Hunting: Methodology-Based Hunting |
| S5532 | Skill in identifying advance persistent threats (APTs) | Skill | Covered | CS, DA, INF, IR, TH, TI, VA | Threat Hunting: Methodology-Based Hunting |
| S5533 | Skill in threat hunting | Skill | Covered | TH | Threat Hunting: Methodology-Based Hunting |
| S5534 | Skill in recognizing network, operating system and application deception techniques | Skill | Covered | IR, TH | Network Forensics: Extracting IoCs & Objects |