Cisco CyberOps Professional study plan

Map the detection engineering lifecycle (data source, telemetry, analytic, alert, tuning) and write a one-page diagram of it in your own words

Deconstruct at least six analytic types (signature, anomaly, behavioral, statistical, correlation, machine-learning-assisted) and state one realistic failure mode for each

Trace how a single process-creation event flows from endpoint sensor to SIEM alert, naming each normalization and enrichment step

Configure a free lab stack (Security Onion, ELK, or Zeek plus a Windows VM) and confirm logs are landing in the index

Identify the ATT&CK tactics and techniques most relevant to credential access, lateral movement, and persistence on Windows and Linux

Write three working detection queries (e.g., KQL, SPL, or EQL) covering suspicious process lineage, encoded PowerShell, and unusual service creation

Analyze authentication telemetry to distinguish brute force, password spray, and valid-account misuse using logon type and failure patterns

Enumerate the telemetry gaps in your lab and document which techniques you currently cannot detect

Apply a structured triage model (severity, scope, blast radius, confidence) to five synthetic alerts and record your disposition rationale

Reconstruct a host-based intrusion timeline from process, file, registry, and network events in a packet capture or EVTX dataset

Differentiate true positive, benign true positive, and false positive using evidence rather than intuition, documenting the deciding artifact each time

Draft a concise incident ticket template capturing what happened, affected assets, evidence links, and next action

Execute the full incident response lifecycle (preparation, detection and analysis, containment, eradication, recovery, lessons learned) against a tabletop scenario

Select containment actions (host isolation, account disable, block rule, token revocation) and justify the operational trade-off of each

Perform memory and disk artifact triage to extract persistence mechanisms and execution evidence

Write post-incident findings that separate confirmed facts, inferences, and open questions

Build an intelligence requirements list tied to your organization's crown-jewel assets and the threats most likely to target them

Apply a structured analytic technique (ACH or key assumptions check) to a threat report and document where confidence drops

Map indicators to ATT&CK techniques and assign a confidence and shelf-life estimate to each indicator type

Compare at least two intelligence-sharing formats and explain the operational cost of acting on unvetted indicators

Formulate three hypothesis-driven hunts (e.g., living-off-the-land binaries, anomalous cloud API calls, uncommon parent-child process pairs) with explicit success and failure criteria

Execute each hunt against your lab data and record query iterations, false positives, and analyst time spent

Convert one successful hunt into a durable detection rule and document the tuning applied

Evaluate hunt outcomes to decide which results become detections, which become monitoring watch items, and which are closed

Design an orchestration playbook for phishing triage that specifies triggers, enrichment steps, decision branches, and human approval gates

Implement one automated enrichment step (reputation lookup, sandbox submission, or asset lookup) and verify it handles API failure and rate limiting gracefully

Define guardrails for automation: what may act autonomously, what requires approval, and how rollback works

Measure the playbook's impact by comparing mean time to triage before and after automation

Consolidate your weakest objectives from all five domains into a ranked review list and close the top ten gaps

Re-run one detection, one hunt, and one incident scenario end to end under time pressure to test recall and workflow fluency

Explain aloud, without notes, how a single intrusion would be detected, triaged, contained, hunted for laterally, and automated against

Build a one-page reference sheet of decision criteria you would want during a live incident