Cybersecurity Tools Bootcamp 2026: SIEM, EDR, SOAR+DevSecOps

Explore network security fundamentals through the OSI model, key protocols, and attack surfaces, and learn how segmentation and zero-trust defenses reduce risk against common network attacks.

Explore stateless, stateful, next-generation firewalls, and web application firewalls (wafs), their architectures and deployment models. Apply deny-by-default rules, document configurations, test changes, and review regularly for effective multi-layer protection.

Learn PfSense installation and configuration to deploy a firewall on FreeBSD, covering WAN/LAN, firewall rules, NAT, and VPNs such as OpenVPN, IPsec, L2TP over IPsec, and WireGuard for remote access.

Explore host-based linux firewalls, from traditional iptables to nftables, and the user-friendly ufw, covering tables, chains, stateful rules, persistence, and practical administration.

Protect web apps at the application layer with ModSecurity and the OWASP core rule set, deploying on Apache or NGINX and tuning CRS rules for real-time protection.

Deploy cloud-based WAFs at internet edge, with AWS WAF, CloudFlare WAF, and Azure Front Door, filtering traffic before it reaches your app, delivering DDoS protection, rule updates, and simple configuration.

Explore Snort architecture, rule structure, and custom rules to implement IDS and IPS detection, tune rules for your environment, and balance coverage with false positives.

Explore Suricata architecture, installation steps, deployment modes, and the Eve JSON logging format. Compare IDS and inline IPS operation, latency impact, and multi-threading advantages for Snort migration.

Analyze network traffic with Wireshark to perform deep packet inspection, filter for relevant traffic, and examine protocols from DNS to TLS to spot anomalies.

Zeek, NetworkMiner, and ntopng enable continuous network visibility and forensics without full packet capture, providing rich logs, artifact extraction, and real-time traffic visualization for SIEM integration and incident response.

Explore infrastructure monitoring with Nagios, Zabbix, Prometheus, and Grafana, learning host health checks, alerting, dashboards, and scalable visibility across servers, networks, and cloud resources.

Leverage VPN technologies like WireGuard and OpenVPN for secure remote access, while using VLANs and DMZs for network segmentation and enforcing zero trust with continuous verification and least privilege.

Explore DNS security tools like PyHole, DNS Crypt, and DNS over HTTPS to detect and prevent attacks, encrypt queries, and protect privacy across the network.

Implement a defense-in-depth network for APEX Digital across AWS and on-premises. Apply edge protections with AWS WAF and Shield, use a bastion host and DMZ segmentation, and enforce zero-trust access.

Learn the full vulnerability management lifecycle from discovery to validation, including asset discovery, automated scanning, analysis, remediation, and verification to prevent exploitable weaknesses.

Conduct systematic reconnaissance and discovery to inventory external assets. Use passive techniques (domain whois, DNS enumeration) and active scans (Nmap, Masscan, Shodan, Census) to map the external attack surface.

Explore open source intelligence tools that turn public information into actionable insights, using Recon NG, The Harvester, Maltego, and Spiderfoot to map domains, subdomains, and emails.

Nessus guides installation and configuration of a comprehensive vulnerability scanner, covering architecture, agent and cloud deployments, credentialed and network scans, scan profiles, and professional reports aligned with compliance standards.

Explore OpenVAS, the open source vulnerability scanner by GreenBone, and learn installation, configuration, policies, credentialed scans, and reporting for siem integration.

Explore the metasploit framework for practical penetration testing, from reconnaissance and scanning to exploitation, post-exploitation, and evasion, using module-based exploits and meterpreter payloads to demonstrate real impact.

Explore advanced Metasploit techniques, including Meterpreter post-exploitation, defense evasion, privilege escalation, lateral movement, and persistence to evade detection and simulate real-world cyber attacks.

Explore Burp Suite Professional to identify the OWASP top 10 web vulnerabilities via automated scanning and manual testing with Repeater and Intruder, using Decoder and Collaborator for thorough testing.

Discover how OWASP ZAP, a free open source web application scanner, uses a proxy for passive and active scanning and integrates with CI/CD pipelines.

Explore sql injection and cross-site scripting testing tools, including SQLMAP, XAssessor, CommMix, and XSSer, to automate vulnerability detection and data extraction in web applications.

Assess password strength and authentication with Hashcat, John the Ripper, and Hydra to uncover weak credentials and prevent account takeover, highlighting GPU-accelerated offline cracking and strong password policies.

Learn wireless network security testing with Aircrack-NG, Kismet, and WiFight. Use passive discovery and active assessment to detect rogue access points and crack weak encryption such as WEP and WPA.

Learn to score and prioritize vulnerabilities using CVSS and EPSS, reference the KIV and CVE catalogs, and communicate remediation plans to executives and technical teams.

Conduct a comprehensive vulnerability assessment of the APEX Digital case study using Shodan, Census, Nmap, Nessus, Burp Suite, and OWASP ZAP to inform a risk-based remediation plan.

Explore what SIEM is and why it's essential for modern security operations. See how log management, event correlation, real-time alerts, dashboards, and compliance reporting come together in a scalable pipeline.

Master the ELK stack for centralized security monitoring and SIEM by configuring Elasticsearch, Logstash, and Kibana with Beats, secure deployment, and practical log ingestion pipelines.

Explore Splunk’s architecture and SPL, including universal forwarders, indexers, and search heads, plus data inputs, dashboards, and security apps for threat hunting.

Explore Wazoo, an open-source unified siem, xdr, and host-based intrusion detection platform that combines log analysis, file integrity monitoring, vulnerability detection, and active response.

Discover centralized log collection strategies for a SIEM deployment, integrating RSized log, Sized log NG, FileBeat, FluentED, and NxLog across Linux, Windows, and network devices for the ELK stack.

Explore Windows event logs and Sysmon, focusing on critical event IDs like 4624, 4625, and 4688, to detect attacks in Active Directory environments and gain process and network visibility.

Learn how SGMA Sigma rules, a vendor-agnostic YAML format, enable log-based threat detection and cross-platform conversion for SIEMs, with correlation rules mapped to MITRE ATT&CK techniques.

Enhance alert management for security operations by integrating ElastAlert and Wazoo rules, tuning thresholds, correlating events, and automating responses to reduce false positives and alert fatigue.

Design actionable security dashboards with Kibana, Grafana, and Splunk for SoC analysts, executives, and compliance teams, mapping to PCI DSS and SOC 2, with real-time visuals and color coding.

Security Onion unites full packet capture, intrusion detection, and log management in a free open-source NSM platform, integrating Suricata, Zeek, Wazoo, Elasticsearch, and Kibana for enterprise-grade monitoring at no cost.

UEBA adds a machine learning layer to detect anomalies against behavioral baselines, enhancing insider threat, compromised account, lateral movement, data exfiltration, and privilege abuse detection for Apex Digital.

Design a complete Apex Digital SIEM strategy with brute force and lateral movement detection, Sigma rules, and an integrated ELK stack and Wazoo for unified monitoring and automated containment.

Trace the evolution of endpoint protection from signature-based antivirus to NGAV, EDR, and XDR. See how Apex Digital uses integrated XDR and automated response to stop modern attacks.

Deploy Wazoo EDR, an open source endpoint detection and response platform with a manager and agents on Windows, Linux, and macOS, delivering file integrity monitoring, rootkit detection, and active response.

Explore CrowdStrike Falcon, a cloud-native EDR with lightweight sensors and threat intelligence. See how IOC and IOA detection, threat hunting, and modular Falcon integrate with SIEM and ticketing for protection.

Explain Microsoft Defender for Endpoint's cloud-native EDR/XDR architecture and kernel-level monitoring via the Windows Defender sensor. Highlight attack surface reduction rules and automated remediation integrating with Microsoft 365.

Compare SentinelOne and Carbon Black as autonomous, ml-driven EDR platforms. Rely on behavioral analysis and ransomware rollback for proactive threat remediation.

Explore xdr platforms that unify detection and response across endpoints, networks, email, cloud, identity, and data through a six-pillars approach, enabling cross-domain threat correlation and automated response.

Secure endpoints by applying CIS benchmarks and DISA STIGs, using tools like Linus and CIS-CAT to assess and enforce baselines, remove unnecessary software, and monitor continuous compliance.

Apply a default deny approach with application whitelisting to block unknown malware. Learn AppLocker, WDAC, and SLinux for policy-based enforcement across Windows and Linux.

Enforce secure deployment and control of mobile devices through mobile device management and mobile application management. Balance bring your own device flexibility with clear policies, app containers, and monitoring.

Learn to write Yara rules to detect malware and automate scanning across networks. Explore integration with siem, edr, and threat hunting for incident response.

Apex Digital implements a six-phase endpoint hardening strategy guided by CIS benchmarks, with app control, mobile BYOD security, and Yara-based threat detection to defend against ransomware.

Explore authentication, authorization, and the laa model within enterprise iam, and examine zero trust, layered authentication, and passwordless methods such as biometrics and fido2 for secure access.

Explore Active Directory architecture, authentication with Kerberos and NTLM, and the enterprise attack surface; learn hardening best practices, from strong passwords and MFA to auditing, least privilege, and constrained delegation.

BloodHound maps AD relationships with graph theory to reveal privilege escalation paths, and Sharphound collects AD data exporting JSON for Neo4j visualization to aid remediation.

Explore how AD hardening mitigates risks in enterprise IAM by using Ping Castle, Purple Knight, and AD Recon to assess, remediate, and monitor Active Directory.

Implement multi-factor authentication with Duo, YubiKey, and FIDO2 to resist phishing and reduce account takeover by combining knowledge, possession, and biometric factors, with adaptive risk-based policies.

Explore single sign-on and identity federation with Okta, Keycloak, and Azure Entra ID, using SAML, OAuth, and OpenID Connect to centralize authentication and improve audit trails.

Learn how privileged access management (PAM) secures administrative accounts and enterprise IAM infrastructure using CyberArk, BeyondTrust, and HashiCorp Vault, enforcing least privilege, just-in-time access with MFA, and session monitoring.

Centralized secret management provides visibility, control, and rotation for credentials like database passwords, API keys, encryption keys, and certificates using HashiCorp Vault, AWS Secrets Manager, and SOPS.

Examine Apex Digital's identity and access management strategy to curb privilege escalation through a comprehensive zero-trust roadmap, PAM, MFA, and secret management across on-premises and cloud.

Explore the shared responsibility model across IaaS, PaaS, and SaaS, detailing provider versus customer security duties and the impact on access controls, compliance, and governance.

Explore AWS security services: GuardDuty, Security Hub, CloudTrail, and Macie to detect threats, audit activity, and protect data, then integrate them with event-driven responses for multi-account security.

Explore Azure Defender for Cloud, Sentinel, and NSGs to detect threats, manage compliance, automate responses with playbooks, and secure multi-cloud and on-premises environments.

Enable Google Cloud Security Command Center to automatically discover resources, monitor vulnerabilities, and score risks with machine learning; integrate Chronicle for threat detection and deploy Cloud Armor with IAM governance.

Explore CSPM tools that monitor cloud configurations against CIS benchmarks to detect misconfigurations and drift. See how Prowler and Scout Suite audit AWS and multi-cloud environments for secure deployments.

CWPP and CNAP secure cloud workloads with runtime protection and behavior-based monitoring, and automated responses across containers and Kubernetes, including image scanning, pod policies, and SIEM integration.

Secure container environments by scanning images for vulnerabilities, monitoring running containers, and preventing misconfigurations. Adopt a multi-layered approach from build-time base image checks to runtime scans and secret detection.

Master Kubernetes security by configuring RBAC, network policies, and pod security standards, and use Kubebench, Falco, Kubehunter, and OPA Gatekeeper for continuous, defense-in-depth protection.

Master IaC security scanning that detects misconfigurations in Terraform, CloudFormation, and Kubernetes before deployment, enabling shift left, automated compliance, and integration with CI/CD pipelines.

Explore how a cloud access security broker (CASB) provides visibility and policy enforcement for SaaS, including MFA, data loss prevention, and blocking exfiltration, with Netscope and Defender for Cloud Apps.

Explore Apex Digital cloud security across AWS infrastructure, including ECS on EC2, Kubernetes clusters, S3, RDS, and DynamoDB, with continuous compliance for SOC 2 Type 2, HiPI, and PCI DSS.

Explore the incident response lifecycle through NIST SP 800-61 and SANS-IR, outlining six phases—preparation, detection, analysis, containment, eradication, recovery—and post-incident review.

Explore the Hive, an open-source incident management platform, for case management, observables, and workflow automation, integrated with Cortex, MISP, and REST APIs for SIEM and ticketing workflows.

Explore DFIR-IRIS, an open-source digital forensics and incident response platform that enables evidence collection, analysis, and reporting with built-in forensic capabilities and chain of custody.

Explore how soar platforms automate incident response by orchestrating tools. Understand the alert ingestion, integration, and playbook engines, and how playbooks, case management, and approval gates enable fast, compliant actions.

Explore Shuffle, an open-source, self-hosted soar platform, with a modern visual drag-and-drop workflow builder. Build workflows that start with a trigger and execute a sequence of actions, avoiding vendor lock-in.

Explore Cortex XSOAR, Palo Alto Networks' commercial SOAR solution, which combines orchestration, automation, and analytics, with 600-plus pre-built integrations and content packs that accelerate detection, response, and case management.

Compare zero-code Tynes with Splunk SOAR for security automation, highlighting multi-tenant zero-code deployments for MSPs and agencies, and Splunk SOAR's deep SIEM integration.

Learn to perform disk forensics using FTK Imager and Autopsy, following imaging procedures, hash verification, and chain-of-custody practices to ensure admissible evidence in court.

Develop memory forensics skills using Volatility 3 to detect malware, analyze running processes and network connections, and support APEX digital incident response against advanced threats.

Analyze network traffic to reveal attacker communication, data exfiltration, and lateral movement using Wireshark and NetworkMiner. Capture PCAPs with TCP dump and analyze DNS and HTTP/HTTPS patterns for threat detection.

Learn malware analysis fundamentals by combining static analysis and dynamic sandbox techniques to reveal malware capabilities, indicators of compromise, and attribution using tools like Ghidra, disassemblers, and Cuckoo.

Explore Velociraptor, an open-source endpoint collection and response platform with a lightweight client, VQL queries, and pre-built artifacts for rapid forensic collection, hunting, and automated response at scale.

APEX Digital demonstrates SOAR-based automation with forensic tools to map tools to IR phases, automate containment, and run malware and phishing playbooks for rapid detection and recovery.

Explore the three levels of threat intelligence—strategic, tactical, and operational. Learn how CTI turns data into actionable insights to inform defense, detection, and security posture.

Master the MITRE ATT&CK framework to map adversary tactics, techniques, and sub-techniques, and evaluate tool coverage, gaps, and defenses for threat hunting and incident response.

MISP is a malware information sharing platform that enables organizations to share structured threat intelligence, IOCs, and attack patterns through events, attributes, and APIs with SIEM, EDR, and partners.

OpenCTI demonstrates a graph-based threat intelligence platform that models threat actors, malware, and attack patterns, with visualizations, timeline views, and GraphQL API integrations for real-time automation.

Explore major threat intelligence feeds, including VirusTotal, AlienVault-OTX, and Abuse.ch, and learn to integrate IOCs into security operations with centralized platforms.

explore purple team methodology that combines red and blue team collaboration to test controls continuously, share findings in real time, and drive measurement-driven security improvements using the mitre atanck framework.

Explore adversary emulation using Atomic Red Team and Caldera to run modular tests and multi-host campaigns, map techniques to detection rules, and measure telemetry for purple team defense.

Explore bias platforms like AttackIQ, SafeBreach, and InfectionMonkey, delivering continuous automated validation of detection and response at scale and enabling data-driven insights for auditors and leadership.

Learn how threat hunting takes a proactive, breach-minded approach to detect evidence of compromise beyond alerts, using hypothesis-driven methods, threat intelligence, and hunting playbooks to guide searches.

Examine C2 framework architecture, detection strategies, and layered defense against Cobalt Strike, Sliver, and Mythic, focusing on beacons, DNS patterns, and behavioral indicators for prevention.

Apex Digital executes a two-week purple team capstone, simulating APT28 to validate detection across the full kill chain from initial access to exfiltration, with red and blue teams coordinating.

Embed security across the ci/cd pipeline from the earliest code creation, embracing shift-left devsecops culture with automated tools like SAST, DAST, IAST, container scanning, and policy as code.

Explore static application security testing (SAST) tools like SonarQube and Semgrep, analyzing code and binaries to detect vulnerabilities before runtime and support shift-left security.

Study dynamic application security testing (DAST) with tools like OWASP ZAP and Nuclei to test running apps, reveal exploitability, and complement static testing (SAST) in staging environments.

Explore software composition analysis and SCA tools such as Snyk, dependency check, and Dependabot to reduce exposure by scanning dependencies, inventorying components, and automating patches in ci/cd.

Explore secret scanning tools like Git leaks, TruffleHog, and Git secrets that detect credentials committed to repositories and integrate pre-commit checks and CI/CD scans for rapid remediation.

Scan docker images and Kubernetes artifacts with Trivi, AnchorA, and Cosign; verify signatures, enforce policies, and maintain minimal Alpine images to prevent production vulnerabilities.

Learn how policy as code enforces security and compliance by automating policy evaluation with tools like OPA, Sentinel, and Kyverno across Kubernetes, Terraform, and CI/CD pipelines.

Automate security operations with infrastructure as code, Ansible for hardening, and Python workflows to patch and remediate at scale using api integrations and webhooks.

Explore Apex Digital's devsecops pipeline, integrating sast, dast, secret scanning, container security, and policy as code. Automated tooling enables shift-left security, continuous monitoring, and secure deployments at scale.