Blue Team Training Course - Introduction

Summary

This video introduces the Blue Team training series sponsored by Linode, aimed at teaching blue team operations. It covers network traffic analysis, intrusion detection, and security event monitoring with tools like Wireshark, Snort, Suricata, and Splunk. The series is split into two parts: Part 1 focuses on foundational concepts, while Part 2 delves into advanced topics like host-based intrusion detection, digital forensics, memory analysis, disk forensics, and incident response. The course is designed to help users build a strong foundation in blue team operations and cybersecurity practices, with the opportunity to use Linode's free $100 credit.

Takeaways

• 😀 Linode, a privately owned cloud hosting company, sponsors this blue team training series and offers a $100 free credit to viewers.
• 😀 The blue team training series is divided into two parts, with Part 1 available for free on YouTube and Part 2 accessible via registration.
• 😀 Part 1 of the series introduces key concepts like network traffic analysis, intrusion detection, threat detection, and security event monitoring.
• 😀 Wireshark is used in Part 1 for network traffic analysis to identify malicious activity.
• 😀 Snort and Suricata are used in Part 1 for intrusion detection and setting up rules to detect malicious network activity.
• 😀 Wazoo is introduced for threat detection in Part 1 of the series.
• 😀 Splunk is covered in Part 1 for security event monitoring, teaching how to set it up for cybersecurity tasks.
• 😀 Part 2 builds upon Part 1, focusing on host-based intrusion detection using OSSEC and expanding on intrusion detection methods.
• 😀 Digital forensics and incident response topics are covered in Part 2, including memory acquisition, forensics, and disk analysis.
• 😀 Tools like Lime, Volatility, Autopsy, and Trivi are covered for memory and disk forensics, and Docker image vulnerability detection.
• 😀 FireEye Redline is discussed for incident response in Part 2, providing a comprehensive approach to handling security incidents.

Q & A

What is the purpose of this blue team training series?

The purpose of the blue team training series is to provide an introduction to blue team operations, focusing on areas such as traffic analysis, intrusion detection, threat detection, and security event monitoring.

Who is sponsoring the blue team training series?

The training series is sponsored by Linode, a privately owned cloud hosting company that is passionate about Linux and contributes to the community by offering free training on Linux, information security, and DevOps.

What bonus does Linode offer to viewers of the series?

Linode offers a $100 credit to viewers, which can be used to explore the Linux platform, create instances or servers, and follow along with the training series.

What are the two parts of the blue team training series?

The series is split into two parts: Part 1, which is available free on YouTube, covers topics like network traffic analysis, intrusion detection, threat detection, and security event monitoring. Part 2, which is also free, requires registration to access on-demand videos and focuses on host-based intrusion detection, memory acquisition and forensics, disk forensics, and incident response.

What topics are covered in Part 1 of the training series?

Part 1 covers network traffic analysis with Wireshark, intrusion detection with Snort and Suricata, threat detection with Wazoo, and security event monitoring with Splunk.

What is the main objective of Part 1 in the blue team series?

The main objective of Part 1 is to introduce participants to blue team operations by teaching them how to analyze network traffic, detect intrusions, identify threats, and monitor security events.

What are some of the tools and technologies introduced in Part 1?

Some of the tools and technologies introduced in Part 1 include Wireshark for traffic analysis, Snort and Suricata for intrusion detection, Wazoo for threat detection, and Splunk for security event monitoring.

How does Part 2 build upon the content from Part 1?

Part 2 builds upon Part 1 by diving deeper into host-based intrusion detection with OSSEC, and then exploring advanced topics such as memory acquisition and forensics, disk forensics, Docker image analysis, and incident response.

What is the focus of the videos in Part 2 of the series?

Part 2 focuses on host-based intrusion detection with OSSEC, memory forensics with tools like Lime and Volatility, disk forensics with Autopsy, Docker image analysis with Trivy, and incident response with FireEye Redline.

Who are the supporters mentioned in the transcript?

The supporters mentioned in the transcript include the series' patrons, such as Michael Hubbard, Dustin Empress, Jerry Speds, Doozy, Sid Saab, Ryan Carr, Shamir Douglas, Jojo, Bibi Balangos, Kushkev, RS Nino Boykov, and David Bricker, whose contributions make these videos possible.