eCDFP study plan
eCDFP · Give each week a clear focus.
8 weeks · About 6 hours per week
Defensive Security Fundamentals
Define each phase of the incident-response lifecycle (preparation, identification, containment, eradication, recovery, lessons learned) and place at least three concrete actions under each phase
Explain the difference between an event, an alert, and an incident, and classify ten sample scenarios into the correct category
Map the MITRE ATT&CK tactics to the kill-chain stages and identify at least one defensive control that disrupts each stage
Describe the CIA triad and the role of logging, monitoring, and retention in supporting each pillar
Summarize the legal and privacy constraints (evidence handling, data minimization, chain of custody) that shape a defensive investigation
Your checkpoint
A one-page incident-response lifecycle cheat sheet with phases, example actions, and the ATT&CK tactic that most often triggers each phase, plus ten classified scenarios with justifications
Defensive Security Fundamentals & Log Analysis and Detection
Identify the fields produced by Windows Security event logging and explain what Event IDs 4624, 4625, 4688, 4720, and 7045 record
Compare Sysmon event types for process creation, network connection, and file creation, and state which fields support detection
Explain how log sources (endpoint, network, cloud, application) differ in fidelity, latency, and retention
Describe the purpose of a SIEM pipeline (collection, parsing, normalization, correlation, alerting) and where false positives originate
Apply the principle of least volatility to decide which evidence to collect first on a live host
Your checkpoint
A log-source reference table listing at least eight event sources, their key fields, and one detection use case per source, with a short note on collection order for volatile evidence
Network Defense and Traffic Analysis
Explain how TCP handshakes, sequence numbers, and connection state appear in packet captures
Identify the fields of DNS queries and responses and describe how tunneling and fast-flux patterns appear in DNS logs
Compare HTTP request and response metadata (methods, host headers, user agents, status codes) and list anomalies worth alerting on
Describe TLS handshake metadata (SNI, certificate subject, JA3-style fingerprints) and explain what is and is not visible without decryption
Interpret NetFlow/IPFIX records to distinguish scanning, beaconing, and bulk data transfer by volume and periodicity
Your checkpoint
An annotated packet-capture walkthrough of one benign and one suspicious session (handshake through teardown) with the fields you would alert on, plus a NetFlow-based beaconing checklist
Network Defense and Traffic Analysis & Endpoint and Host Defense
Explain how a proxy or web gateway logs URL categories, bytes transferred, and user identity, and how to pivot from proxy logs to endpoint logs
Describe common command-and-control patterns (DNS beaconing, HTTPS callbacks, domain fronting) and the network evidence each leaves
Identify Windows process ancestry anomalies (for example, office applications spawning script interpreters) and the event fields that reveal them
Explain persistence mechanisms on Windows and Linux (services, scheduled tasks, run keys, cron, systemd units) and where each is logged
Describe how endpoint detection and response telemetry differs from native OS logging and what additional context it provides
Your checkpoint
A detection matrix mapping five attacker techniques to at least two independent data sources each (one network, one endpoint) with the specific field values you would match
Log Analysis and Detection
Write detection logic for three techniques using a query language (for example, process creation with encoded arguments, service installation from a temp path, and repeated failed logons)
Explain how to tune a noisy rule using allowlists, thresholds, and context enrichment without losing true positives
Describe how log normalization and field mapping affect correlation across heterogeneous sources
Analyze a timeline of events from mixed sources to reconstruct a sequence of attacker actions
Explain the role of baselining and anomaly detection alongside signature-based rules
Your checkpoint
Three working detection rules with documented logic, expected false-positive sources, and a tuning note, plus a reconstructed timeline from at least fifteen mixed-source events
Endpoint and Host Defense & Incident Response and Threat Hunting
Describe host-based evidence sources (file system metadata, registry, prefetch, shimcache, event logs) and what each can prove
Explain containment options on an endpoint (isolation, process termination, credential reset) and the trade-offs of each
Apply a threat-hunting loop (hypothesis, data source selection, query, validation) to one technique from the detection matrix
Describe how to scope an incident by identifying all hosts and accounts that share an indicator or behavior
Explain how to preserve evidence while isolating a host without destroying volatile data
Your checkpoint
A threat-hunting report for one hypothesis, including queries run, findings, scoping decisions, and a containment recommendation with rationale
Incident Response and Threat Hunting & Log Analysis and Detection
Draft an incident-response runbook for one scenario (for example, credential theft or ransomware) with roles, decision points, and communication steps
Explain how to build a timeline that reconciles clock skew and time zones across sources
Describe metrics that measure detection and response effectiveness (time to detect, time to contain, false-positive rate) and how to collect them
Explain how lessons-learned findings feed back into detection rules and controls
Describe how to document an investigation so another analyst can reproduce the findings
Your checkpoint
A complete incident runbook for one scenario with a reconciled timeline, decision tree, and a lessons-learned section that proposes at least two concrete detection improvements
Defensive Security Fundamentals & Network Defense and Traffic Analysis & Endpoint and Host Defense & Log Analysis and Detection & Incident Response and Threat Hunting
Review weak areas identified in earlier weeks and close at least three specific knowledge gaps
Explain how the five domains interlock in a single end-to-end investigation from alert to containment
Practice explaining detection logic and evidence handling decisions aloud in concise, defensible terms
Verify recall of key event IDs, log fields, and protocol metadata without reference material
Your checkpoint
A consolidated one-page quick-reference sheet covering key event IDs, log fields, and protocol metadata, plus a self-assessment listing remaining weak areas with a remediation plan
Milestones
Week 2: Can explain the incident-response lifecycle, classify events versus incidents, and name the key fields of at least five Windows and Sysmon event types from memory
Week 4: Can walk through a packet capture and a NetFlow record and state which fields support beaconing, scanning, and data-transfer detection, and can map five techniques to network and endpoint data sources
Week 6: Can write and tune a detection rule, reconstruct a mixed-source timeline, and complete a threat-hunting loop from hypothesis to containment recommendation
Week 8: Can produce a complete incident runbook, reconcile a multi-source timeline, and recall key event IDs and log fields without notes