Wireshark for SOC Analyst & AI-Powered Analysis

Understand cyber security as a practice to protect systems from unauthorized access, ensure data integrity, confidentiality, and availability, and explore core areas like network, information, and endpoint security.

Explore common cyber attacks such as malware (ransomware, spyware, adware, viruses), man-in-the-middle, password attacks, phishing, denial-of-service, botnets, and web vulnerabilities like SQL injection, cross-site scripting, and cross-site request forgery.

A security operations center, or SOC, is a centralized unit that detects, prevents, and responds to threats in real time using SIEM and EDR, guided by incident response.

Explore core soc tools for detection and response—sim, edr, threat intel, incident response, and itsm—and how soar workflows enable automation.

Explore the OSI model framework and its seven layers from physical to application, showing data link and network layer roles, MAC and IP addresses, switches, and routers.

Learn to customize Wireshark preferences to tailor appearances, columns, fonts, and colors. Configure captures, promiscuous mode, and PCAPNG outputs; optimize name resolution, protocols, and expert filters for security analysis.

Explore packet list, packet details, and packet bytes in Wireshark, correlating layers from frame to application, including MAC addresses, IP addresses, ports, and hex data.

Highlight and distinguish network traffic in Wireshark by creating color rules for specific packets, such as TCP flags and urgent traffic, to aid malware and protocol analysis.

Understand the fin flag and fin three-way handshake to close connections, analyze flags such as synac, finac, and ack in Wireshark for soc analysis.

Learn packet structure and header breakdown in Wireshark, reading a packet across frame, Ethernet, IP, transport, and application layers, and filtering by IP, port, and protocol for SOC analysis.

Explore how the DNS works from resolver to authoritative servers, and detect anomalies like low TTL, fast flux, and CNAME clocking used in attacks.

Explore how attackers use SYN scans to map open, closed, and filtered ports in real captures, surface the attack surface with Wireshark filters and nmap demonstrations.

Explore ICMP for host discovery and DDoS, including ping sweeps and ping floods, and learn to identify these patterns in Wireshark with ICMP filters.