Module 1: Networking
- Introduction to networking
- OSI and TCP/IP models – encapsulation and de-encapsulation
- Layer 1 in short
- Layer 2 protocols & Switch (layer 2) operation
- Layer 3 protocols & Address Resolution Protocol (ARP)
- Point to point delivery
- Layer 4 protocols & Application protocols
- Introduction to Google Gemini, prompt engineering, AI limitations and responsible use
- AI-assisted traffic analysis and troubleshooting with Gemini and Wireshark, including scan identification and packet-based verification
- VirtualBox network adapters
Module 2: Operation Systems On Prem
- Windows OS & Windows shells (CMD and PowerShell)
- What is a server
- Active Directory centralized unit & AD objects management
- Applying group policy & GPO templates
- AI-assisted PowerShell explanation and debugging with Google Gemini, including laboratory validation
- Active Directory and Group Policy hardening review with Gemini, verified against Microsoft documentation
- AD authentication (NTLM & Kerberos authentication)
- Active Directory Hardening
Module 3: Linux
- Open-source concepts
- Importing the VM & Introduction to the shell
- Users and groups & Permissions
- Remoting (SSH Client) & SSH protocol explained
- Processing text with delimiters
- Package management & Hash algorithms
- Find binaries and documentation (which, whereis)
- AI-assisted Linux troubleshooting and Bash debugging with Google Gemini, including verification in a Linux laboratory
Module 4: Anatomy of an Attack
- Introduction to reconnaissance (OSINT)
- The cyber kill chain and MITRE
- Active scanning & Brute force attacks
- Introduction to vulnerabilities and CVEs
- CVE research with Gemini and Gemini Notebook, verified against vendor advisories
- Evidence-based MITRE ATT&CK mapping with Gemini and official MITRE documentation
- Command-line artifact analysis with Gemini and safe decoding with CyberChef
- Remote control & Introduction to client-side attacks
Module 5: SIEM/SOC
- The importance of SOC & SOC Roles
- MITRE ATT&CK & IP Investigation / Public Tools
- What is Incident Response
- Common Attack Investigation – DDoS / Malware / Ransomware
- Event Viewer & SIEM Introduction (Definitions and Terms)
- SIEM Architecture – Wazuh / Qradar / Splunk
- Malware Analysis (Static & Dynamic)
- AI-assisted log investigation with Gemini, including data redaction and evidence verification
- SIEM search query development with Gemini & Testing against laboratory events
- Static analysis of inert PowerShell scripts with Gemini and public hash enrichment with VirusTotal
- Structured alert triage in JSON with Gemini and optional Google AI Studio
- Incident response reporting with Gemini and Gemini Notebook, based on independently verified investigation findings
- Ransomware & Endpoint Security Systems (EDR Importance, Open EDR / Lima Charlie)
*Changes may apply