Building Lakeshore Health's network detection and response program: a hospital network that was watched only by endpoint agents and a core-switch SPAN port that dropped packets, now instrumented with taps on east-west links, cloud traffic mirrored in and agentless medical devices such as infusion pumps and PACS imaging covered; the eight-layer network visibility stack from sensor placement, capture and flow, encrypted traffic analytics, baselines, detection content, investigation and response up to program metrics; and one case where a billing workstation beaconing every 60 seconds is caught by its regular interval, quarantined through a playbook instead of a 45-minute phone call, with guardrails that never auto-isolate clinical devices.

CY-SENIOR-081Senior Level · Network Detection & Response Program

Network Detection & Response Program — The Network Visibility Stack

A senior-level program-building course that takes a network from EDR-only and blind to actually watched, detected, and defended. Work the network visibility stack - eight layers: Sensor Placement, Traffic Capture & Flow, Encrypted Traffic Strategy, Baselines & Behavioral Analytics, Detection Content, Investigation & Forensics, Response Integration, and Program Metrics - with real tap and sensor placement, NetFlow/Zeek/PCAP, JA3/JA4 and TLS analytics, beaconing detection, Suricata/Zeek content mapped to MITRE ATT&CK, session reconstruction, SOAR/EDR/NAC response integration, and coverage and MTTD metrics, on a hospital network with flat legacy segments and agentless medical devices. Four hands-on activities in every lesson.

16 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Place sensors at real choke points - including east-west and agentless devices - and capture flow and packets deliberately against a retention budget.
Apply encrypted-traffic analytics as the default approach to TLS, reserving selective, scoped decryption for cases that truly need it.
Baseline assets and peer groups and build signature and behavioral detection content, mapped and tuned against MITRE ATT&CK, that analysts actually trust.
Investigate by pivoting from alert to flow to packet with evidence intact, and wire validated findings to automated response and program metrics.

Price:৳10,000