Day 1 begins with an instructor-led dive into some of the latest, more advanced threat hunting tools and methodologies; basic hunting concepts are assumed known at this point. The opening intrusion scenario will weave multiple adversary techniques together, emulating prolific threat groups, so students can hone their investigative skills combined with threat intelligence and investigation tracking. An instructor is present to guide students throughout the scenario and an end-of-day debrief will provide students an attacker and defender perspective of the intrusion.

Day 2 of Operations is an opportunity for students to utilize learned techniques and examine multi-faceted, enterprise-wide attacks. Our simulated "enterprise network" will be experiencing multiple simultaneous attacks which students need to detect, prioritize and investigate. This requires thorough data correlation and attack profiling by students - possibly in the face of additional ongoing attacks. This becomes the ultimate test of even the most seasoned defenders; can you rapidly respond to multiple real-time threats against the organization and piece together adversary attack chains based on pressing questions posed by stakeholders?

By the end of the NDR Operations, students will have significantly improved their incident response and tracking techniques. They will leave the course with improved team collaboration and enrichment, advanced detection capabilities, tools for incident tracking, and new approaches to hunt evil in their networks.

NDR Core is the Essentials and Operations courses combined into a 4 day event. This course is perfect for beginners who want a foundation with threat groups and attacker techniques.

The majority of the course will be a blend of adversary hunting, investigative build-out, and interactive class dissections of observed activity. We will pause throughout the course to examine adversary activity and provide students a unique "behind-the-curtain" look at attack orchestration. This is a multi-fold approach: students without attack experience will gain an understanding of how attackers operate, advanced students can compare findings against the actual attack, and teams can more effectively coordinate to address the attacker's actions. We provide technical insight into vulnerabilities and weaknesses the attacker exploited and discuss defensive implementations. We also highlight and emphasize opportunities for increased coordination and communication within participating teams.

By the end of NDR Core, students will have a solid foundation for threat hunting and incident response and will have gained significantly improved incident response and tracking techniques. They will leave the course with advanced detection capabilities, tools for incident tracking, collaboration and enrichment, and a new approach to hunt evil in their networks.