AI SOC Analyst / Vulnerabilities and the software supply chain / Finding and ranking the vulnerabilities in your own lab Contents Vulnerabilities and the software supply chain Contents of the book Start here The opening pages Introduction: what this course builds free Before you start free Your lab's first alert, checked end to end Part 1 The SOC from zero What a security operations centre does all day free What an alert is, and why most alerts are noise Logs are the evidence every investigation starts from Reading a Linux login log by hand Windows event logs and Sysmon in plain words How an attack unfolds, step by step The triage routine a junior analyst follows Writing an incident ticket by hand Part 2 Wazuh, a real SIEM, hands-on What a SIEM does coming How Wazuh is built coming Adding machines to Wazuh coming Watching a real attack become an alert coming Searching alerts like an analyst coming Noticing when an important file changes coming Finding vulnerable software and weak settings coming How a raw log becomes an alert coming Writing your first detection rule coming Blocking an attacker automatically, and why to be careful coming Part 3 MITRE ATT&CK and detection engineering MITRE ATT&CK in plain words coming Reading your own alerts through ATT&CK coming Running safe attack tests on your own lab coming Sigma, a detection rule you can share coming Running a Sigma rule against Wazuh data coming Writing your own Sigma rule coming Keeping detections in Git and testing them coming Measuring whether a rule is any good coming Catching attacks that only show up as a pattern coming Part 4 Threat intelligence and threat hunting, by hand Indicators of compromise, and their limits coming Enriching an alert with public threat intelligence coming Sending Wazuh alerts to other tools coming What threat hunting is coming A real hunt on a public attack dataset coming Writing up a hunt coming Vulnerabilities and the software supply chain The opening pages What a vulnerability is, and what a CVE is coming CWE: the weakness behind the bug coming CVSS: how a vulnerability is scored coming CPE: naming the software that is affected coming Looking up a CVE in the NVD, by hand and with a script coming What to fix first: EPSS and the KEV catalog coming SBOM: the list of everything your software is built from coming Package and supply-chain attacks coming Finding and ranking the vulnerabilities in your own lab coming Part 5 AI agents from zero, for analysts What a language model really does coming Getting answers your code can check coming What an AI agent is free Giving an agent safe tools on Wazuh coming Every log line may be written by the attacker coming Building a triage agent as a graph coming Making the agent ask a person first coming Knowing what each investigation costs coming Part 6 The AI SOC team Grouping an alert storm into one case coming The triage agent coming The enrichment agent coming The hunting agent coming The incident report writer coming Proposing containment, with a person approving coming The supervisor that runs the case coming A simple console for the analyst coming When the agents go wrong coming Part 7 Attack graphs with Neo4j Why an attack is easier to see as a graph coming Neo4j from zero coming Loading MITRE ATT&CK into Neo4j coming Turning your alerts into a graph coming Finding the path an attacker took coming Letting the agent ask the graph coming Part 8 Prove it, and get the job What it means for a triage agent to be good coming Building a labelled test set from your own lab coming Scoring the agents by code coming Judging the incident reports fairly coming Numbers you can trust coming Attacking your own agents coming Capstone: one full incident, start to finish coming The report a SOC manager asks for coming Turning the course into a job coming Vulnerabilities and the software supply chain
Finding the vulnerabilities on your lab servers with Wazuh and turning them into a prioritised fix list Building on Wazuh's vulnerability detection from Part 2, each finding on the lab servers joined to its EPSS score and KEV status by your own script, and a fix list a team could act on this week.
This page is being written and is not published yet Pages are published in book order. Everything published later is included when you buy the course.
See the contents of the book or read what the course covers .