CISP-TRE study plan
CISP-TRE · Give each week a clear focus.
8 weeks · About 7 hours per week
Threat Intelligence and Analysis
Build a threat-intelligence vocabulary sheet covering the intelligence cycle, collection disciplines (OSINT, SIGINT-adjacent feeds, commercial and ISAC feeds), and the difference between tactical, operational, and strategic intelligence, with one real example per tier
Classify at least 10 indicator types (IP, domain, URL, file hash, JA3/JA3S fingerprint, user-agent, mutex, registry key) by durability and pivoting value, and write a one-line justification for each ranking
Apply a structured analytic technique (ACH or key-assumptions check) to a public intrusion report and document at least three competing hypotheses and the evidence that discriminates between them
Map a named threat actor's TTPs to at least 15 ATT&CK techniques and note which techniques are detection-friendly versus intelligence-only
Your checkpoint
A 2-page threat-intelligence reference: actor-to-ATT&CK mapping table plus an indicator durability ranking with justifications
Threat Hunting and Detection Engineering
Convert five ATT&CK techniques from week 1 into hypothesis-driven hunt plans, each stating the data source, the expected telemetry fields, and the false-positive conditions
Write at least three Sigma rules and validate each against a sample log set or a local test harness, documenting tuning iterations
Distinguish behavioral detection logic from indicator matching by rewriting two IOC-based rules into behavior-based equivalents
Define a detection lifecycle (propose, test, deploy, tune, retire) and apply it to one rule end to end
Your checkpoint
A hunt-and-detection package: five hunt plans, three validated Sigma rules, and a completed lifecycle record for one rule
Incident Response and Handling
Draft an incident-response playbook for one scenario (ransomware or business email compromise) with phases aligned to NIST SP 800-61r2/800-61r3, entry criteria, and decision points
Practice triage on three synthetic alerts, assigning severity using a documented matrix and recording the reasoning for each call
Produce a containment-options comparison (host isolation, account disable, network ACL, credential rotation) listing blast radius, speed, and evidence-preservation tradeoffs
Write an executive and a technical incident update for the same event, each under 200 words, showing the difference in audience framing
Your checkpoint
A complete IR playbook for one scenario plus three triage write-ups and two audience-specific incident communications
Malware Analysis and Reverse Engineering Fundamentals & Network Security Monitoring and Traffic Analysis
Perform static triage on a safe sample (strings, PE headers, imports, entropy, packer indicators) and record findings in a structured analysis note
Observe live network behavior of a benign or sandboxed sample in an isolated lab, capturing DNS, HTTP, and TLS metadata, and identify at least three network artifacts usable as detection pivots
Analyze a PCAP containing a known technique (DNS tunneling, beaconing, or data exfiltration) and derive a detection rule from the observed pattern
Explain how to handle malware safely: isolation requirements, snapshotting, and what must never leave the lab
Your checkpoint
A malware triage report with static findings, network artifacts, and one PCAP-derived detection rule
Endpoint Detection and Response
Compare EDR telemetry categories (process creation, image load, file, registry, network, memory) across at least two vendor models and note which fields are needed for the week 2 hunt plans
Write three behavioral detections using process ancestry, command-line, and parent-child relationships, and test each against benign admin activity
Design a response-action matrix mapping detections to automated versus human-approved actions (isolate, kill, quarantine, collect memory)
Identify at least four common EDR blind spots or tampering techniques and describe the compensating telemetry source for each
Your checkpoint
An EDR detection and response matrix: three tested behavioral rules, an action-approval table, and a blind-spot compensation list
Security Operations Center (SOC) Operations and Automation
Map a SOC workflow from alert ingestion to closure and identify at least three automation candidates with measurable time savings
Build or document one SOAR playbook (enrichment, deduplication, or auto-triage) including failure handling and rollback
Define at least six SOC metrics (MTTD, MTTA, MTTR, alert-to-incident ratio, false-positive rate, coverage) with formulas and target ranges
Draft an escalation and handoff procedure covering severity thresholds, on-call contact paths, and what must be in a handoff note
Your checkpoint
A SOC operations pack: one documented SOAR playbook, a metrics dashboard definition with formulas, and a written escalation procedure
Digital Forensics and Evidence Handling
Document a chain-of-custody form and apply it to a simulated evidence-collection exercise, recording hash, collector, time source, and storage location
Explain order of volatility and justify a collection sequence for a running host, including what is lost at each step
Describe how to acquire and verify disk and memory images and how to document integrity for each
Analyze a small forensic artifact set (event logs or file-system timeline) and write findings that would survive scrutiny, separating fact from inference
Your checkpoint
A forensic evidence package: completed chain-of-custody record, collection sequence rationale, and a short findings report with fact/inference separation
Threat Response Engineering and Tooling & Threat Intelligence and Analysis & Threat Hunting and Detection Engineering & Incident Response and Handling
Build or script one reusable response tool (log collector, IOC sweeper, or enrichment helper) with input validation, logging, and a usage note
Integrate the week 1-7 artifacts into a single response runbook that references the intelligence, detections, playbook, and evidence steps
Complete a timed 60-question mixed-domain practice set and review every miss to a root cause (knowledge gap, misread, or guess)
Revisit the two weakest domains from practice results and close at least three specific gaps with written notes
Your checkpoint
A reusable response tool with documentation, an integrated end-to-end runbook, and a practice-exam error analysis with remediation notes
Milestones
Week 2: Can explain the difference between an IOC match and a behavioral detection, and show three Sigma rules that passed validation with tuning notes
Week 4: Can walk through an IR playbook decision point, triage a synthetic alert aloud, and derive a network detection from a PCAP without notes
Week 6: Can describe the full alert-to-closure SOC workflow, quote six metric formulas, and explain one SOAR playbook's failure handling
Week 8: Scores at least 75% on the timed mixed-domain practice set and has a written remediation plan for every missed domain