TOTAL: CompTIA CySA+ Cybersecurity Analyst (CS0-004)

Logging is introduced as a foundational security operations concept, covering how logs are ingested, configured, and retained. Key topics include ensuring log integrity and security, and why time synchronization matters for accurate event correlation.

Foundational operating system and device concepts are introduced, covering system hardening, file structures, critical system files, and system processes. Mobile and endpoint device management are also addressed as part of the broader device landscape analysts encounter.

A focused look at file formats relevant to security analysis, with emphasis on Windows Event Log files (EVTX). Analysts learn to recognize these formats as they appear in log analysis and investigation workflows.

The infrastructure types that define modern and industrial environments are covered here — from cloud-native, virtualized, and containerized architectures to operational technology (OT), industrial control systems (ICS), and SCADA. Analysts learn to recognize these environments to assess their unique security postures.

A survey of the system types an analyst is likely to encounter, including varied infrastructure architectures and device categories. This episode reinforces device management concepts while broadening the view to include OT and ICS environments.

Identity and access management is examined alongside key network architecture concepts including Zero Trust Network Access (ZTNA) and SASE. This episode covers how authentication, authorization, privileged access management (PAM), and secrets management work together to control who — and what — can access systems.

Encryption techniques and data protection concepts are introduced in the context of infrastructure security, covering how data is protected at rest and in transit.

The governance considerations surrounding AI in security operations are addressed here, including legal and regulatory compliance requirements and the importance of clear AI usage policies within an organization.

The risks introduced by AI tools in the security environment are examined — from hallucinations and unintended data exposure to the threats of model poisoning and malicious prompt injection. Analysts learn to evaluate AI tools critically, not just use them.

Practical AI use cases in security operations are explored, showing how analysts can apply AI to tasks like log analysis, event correlation, incident investigation, and documentation. The goal is to help analysts recognize where AI adds value — and where human judgment is still required.

Security automation and orchestration are introduced through tools like SOAR and infrastructure as code (IaC), alongside integration techniques using APIs, webhooks, and plug-ins. This episode also covers data enrichment, alert tuning, and dashboard creation as part of a mature security operations workflow.

Scripting is introduced as a practical security analyst skill — not a developer task — with coverage of Python, PowerShell, and shell scripting for automating repetitive tasks and processing data at scale.

Effective security operations depend on standardized, repeatable processes. This episode covers how teams build and maintain playbooks and runbooks, coordinate response activities, and streamline operations to improve consistency and reduce response time.

The major attack methodology frameworks used in cybersecurity are introduced, including the cyber kill chain, Diamond Model of Intrusion Analysis, MITRE ATT&CK, OSSTMM, and the OWASP Testing Guide. Analysts learn how these models are used to understand, document, and respond to adversary behavior.

Network-based indicators of attack are examined here, including how to identify rogue devices and enumeration activity. The episode also covers living-off-the-land techniques — using LOLBins and scripts — and their tell-tale signs such as unauthorized file system changes, data exfiltration, and configuration tampering.

Identity-based attack indicators are the focus of this episode, covering how analysts recognize signs of IAM account compromise, unauthorized access attempts, and impossible travel patterns that suggest credential misuse or account takeover.

Host-based attack indicators and the tools used to detect them are covered here. The episode addresses application-related indicators alongside endpoint security technologies — EDR, XDR, and MDM — and how analysts use these tools to surface suspicious activity on endpoints.

Cloud and application environments present unique indicator patterns. This episode covers how analysts identify anomalous activity and resource compromise in cloud environments, as well as application-layer indicators that may signal an active attack.

Email-based and social engineering attack indicators are examined, including typosquatting, the misuse of URL shorteners, and business email compromise (BEC) patterns. Analysts learn to recognize the markers of these high-volume, human-targeted attack vectors.

An introduction to the threat actor landscape, focusing on the characteristics and motivations of advanced persistent threats (APTs) and insider threats. Understanding who the adversaries are informs how analysts prioritize and contextualize the threats they investigate.

Tactics, techniques, and procedures (TTPs) are introduced as the language of threat intelligence, alongside tools used to assess and visualize threat activity — including heat maps, the pyramid of pain, and MITRE ATT&CK. Analysts learn how TTPs drive more actionable intelligence than simple indicators alone.

The sources and platforms used to collect threat intelligence are explored, including open-source tools like OTX, MISP, and OpenCTI, as well as the distinction between open-source (OSINT) and closed-source intelligence collection methods.

Not all threat intelligence is equal. This episode covers the properties used to evaluate intelligence — attribution, confidence, timeliness, relevance, and accuracy — along with the intelligence lifecycle and the distinction between atomic and behavioral indicator types.

The full cycle of cyber threat intelligence is examined, from collection and analysis through to application. This episode also introduces threat modeling using STRIDE, threat mapping techniques, and the role of cyber deception as a proactive intelligence strategy.

Security Information and Event Management (SIEM) is introduced as the central platform for log aggregation and event correlation in a SOC. This episode covers how analysts use SIEM to analyze log data, correlate events across sources, and surface actionable alerts.

Packet analysis tools and techniques are covered, including hands-on use of Wireshark, tcpdump, Snort, Suricata, and Zeek. Analysts learn how to capture, filter, and interpret network traffic to identify suspicious activity and potential threats.

File analysis, sandboxing, and debugging tools are introduced, including Strings, VirusTotal, and YARA for static file analysis, Joe Sandbox and Cuckoo Sandbox for dynamic behavioral analysis, and debuggers like Immunity and GDB for deeper binary inspection.

Additional analyst tools are covered, including CyberChef for decoding and parsing data, regular expressions and command interpretation for pattern recognition, MXToolbox for email header analysis, and OpenUBA for user and entity behavior analytics.

Reconnaissance and assessment tools are explored, including Maltego and Recon-ng for open-source intelligence gathering, alongside domain and IP reputation analysis using WHOIS.

Network scanning and mapping tools are introduced, including Angry IP Scanner, Masscan, and Nmap for host discovery and port scanning. The Metasploit Framework is also covered in the context of identifying and validating vulnerabilities across a network.

Web application scanning tools are covered, including Burp Suite, OWASP ZAP, Arachni, and Nikto. Analysts learn how these tools are used to identify common web application vulnerabilities as part of an assessment workflow.

Dedicated vulnerability scanning platforms are introduced, with coverage of Nessus, OpenVAS, and Nuclei. This episode focuses on how analysts configure and run vulnerability scans and how to interpret scan output for further analysis.

Adversary emulation and attack simulation tools are introduced, including Atomic Red Team and Caldera. Analysts learn how these tools are used to safely replicate attacker behavior in a controlled environment to test detection capabilities and validate defenses.

Cloud and container security assessment tools are the focus of this episode, including Scout Suite, Prowler, Pacu, Trivy, and Checkov. Analysts learn how these tools are used to evaluate cloud configurations, identify misconfigurations, and assess container and infrastructure-as-code security.