Security Operations
Security operations is the largest CySA+ CS0-004 domain and centers on continuously monitoring, analyzing, and hunting across logs, networks, and endpoints. Analysts correlate data in a SIEM, investigate EDR alerts, and apply threat intelligence to detect adversary behavior. Mastering this domain means turning raw telemetry into actionable detections and proactive hunts.
Log, Network, and Endpoint Analysis
Analysts examine authentication logs, DNS queries, flow records, and endpoint telemetry to spot anomalies. Log analysis surfaces suspicious logins and privilege changes, while network analysis reveals beaconing and data exfiltration through traffic patterns. Endpoint analysis via EDR exposes process trees, command-line arguments, and persistence mechanisms. Correlating these three data planes builds a complete picture of adversary activity.
SIEM and Detection Engineering
A SIEM aggregates and correlates events from many sources to generate alerts and dashboards. Effective operations require tuning rules to cut false positives without creating blind spots, and enriching events with context like geolocation and asset criticality. Detection engineering translates known adversary techniques into durable, testable rules. Well-tuned correlation reduces analyst fatigue and speeds real incident identification.
Threat Intelligence, IoCs, and TTPs
Threat intelligence provides context on adversaries, their infrastructure, and their methods. Indicators of compromise such as hashes, IPs, and domains enable fast matching but change easily, sitting low on the Pyramid of Pain. Tactics, techniques, and procedures describe durable behavior that is harder for attackers to alter. Consuming and operationalizing intelligence sharpens both detection and hunting.
MITRE ATT&CK and Behavioral Detection
MITRE ATT&CK is a knowledge base of adversary tactics (goals) and techniques (methods) observed in the wild. Mapping detections to ATT&CK reveals coverage gaps and prioritizes new detection content. Behavioral analytics catches living-off-the-land abuse of trusted binaries that signature tools miss. Analysts use ATT&CK as a common language across hunting, detection, and reporting.
Malware Analysis, Sandboxing, and Threat Hunting
Suspicious files are examined through static analysis of strings and structure and dynamic analysis in an isolated sandbox. Sandboxing detonates samples to observe file, registry, and network behavior safely. Threat hunting is a proactive, hypothesis-driven search for adversaries that evaded automated detection. Together these practices assume compromise may already exist and seek to prove or disprove it.