Module 1: Introduction to Cybersecurity – What is Cybersecurity? – Importance of Cybersecurity in to Module’s world – CIA Triad (Confidentiality, Integrity, Availability) – Real-world cyber incidents – Q&A

Module 2: Threat Landscape & Attack Frameworks – Common threat types: Malware, Phishing, Ransomware – Cyber Kill Chain explained – MITRE ATT&CK Introduction – Case studies of recent attacks

Module 3: Security Domains Overview – Network Security – Application Security – Endpoint Security – Cloud Security – Identity & Access Management

Module 4: Lab Environment Setup – Intro to VirtualBox / VMware – Installing Kali Linux & Windows 10 VMs – Networking setup between VMs – Snapshot management

Module 5: Basic Reconnaissance Techniques – ping, nslookup, traceroute – WHOIS, DNSdumpster – nmap basics (scan types)

Module 6: Types of Security Controls – Preventive, Detective, Corrective – Administrative, Physical, Technical Controls – Examples in corporate environments

Module 7: Recap and Assignment Brief – Weekly quiz (15 questions) – Assignment: Threat actor scenario analysis – Peer discussion & doubt-clearing

Module 1: Networking Fundamentals – OSI Model vs TCP/IP – TCP/UDP basics – Common ports & protocols (HTTP, HTTPS, DNS, etc.)

Module 2: Network Security Tools and Concepts – Firewalls, IDS, IPS – NAT, DMZ, VLAN – Proxies and Packet Filtering

Module 3: Packet Analysis Basics (Wireshark Part 1) – Wireshark Interface overview – Filters and capture process – Analyze HTTP/HTTPS, DNS packets

Module 4: Detecting Attacks with Wireshark (Part 2) – ARP spoofing, DNS poisoning – TCP SYN flood – Exporting packet logs

Module 5: Traffic Analysis Lab – Live capture of different traffic types – Identify anomalies in network traffic

Module 6: Simulated Network Attacks – Simulate DoS using hping3 – MITM using Ettercap or bettercap – Logs and mitigation techniques

Module 7: Weekly Review and Assignment – Quiz – Packet analysis exercise submission

Module 1: SIEM Fundamentals – What is SIEM? – Architecture and Flow (Collection, Normalization, Correlation) – Example SIEM tools (Splunk, Wazuh, QRadar)

Module 2: Introduction to Wazuh – Architecture – Elastic Stack integration – Manager, Agent, Filebeat overview

Module 3: Installing Wazuh – Ubuntu setup for Wazuh manager – Adding agents (Windows & Linux) – Initial troubleshooting tips

Module 4: Collecting Logs with Sysmon & Auditd – Sysmon configuration on Windows – Auditd rules on Linux – Sending logs to Wazuh

Module 5: File Integrity Monitoring Lab – FIM configuration in Wazuh – Creating file monitoring rules – Validate alerts on file tampering

Module 6: Custom Rules & Decoders – Understanding default rule sets – Creating a custom rule – Writing basic decoder for log pattern

Module 7: Real-Time Use Cases in Wazuh – Unauthorized login detection – Privilege escalation tracking – Weekly review and Q&A

Module 1: Incident Response Lifecycle – NIST IR Phases – Key roles in IR team – IR documentation & reporting

Module 2: Endpoint Security Basics – Difference: AV, EDR, XDR – Host-based protection – IOC vs IOA

Module 3: CrowdStrike Falcon Overview – Falcon console tour – Sensor deployment planning – Supported OS and deployment options

Module 4: Falcon Sensor Installation – Hands-on sensor install – Basic policy setup – Ensuring sensor visibility

Module 5: Falcon Detection Use Case – Simulate malware execution – Observe detections – Alert breakdown

Module 6: Ransomware Simulation Lab – Simulate a ransomware dropper – Detection and response in Falcon – Endpoint isolation

Module 7: Policy Management and Threat Hunting – Creating/editing prevention policies – Search and filter in Falcon console – Threat Graph overview