Okay, So guys, first of all, like, welcome everyone, myself, Raghu, I'm in industry more than
13 years of I have the experience and I'm working as you know, a wide variety of technologies, right
from the game industry, gaming industry to the mobile industry, and then after that into the security
industry as part of like, you know, the security.
Um, I mean, like as a the core, I have chosen it only the reason that this for the sake of, uh,
you know, the job security as well.
Okay, Um, beyond that, uh, when it comes to I am a crypto nerd as well, okay?
Like from past four years, um, and I love, you know, the teaching.
Okay, so, so it's my passion as well.
So that's the only reason why extract some amount of time.
Even though I'm a little busy with the day to day my regular office works, I'll extract some time for
this and I'll be like, you know, uh, like training the people.
So why I'm interested in this area was I'm having like the experience in other fields also.
Like, you know, I'm a very good programmer when it comes to the python and all because I have you.
If you would have gone to my YouTube channel, you might have seen me teaching some python as well.
But I didn't, you know, like got so much interest than what I get it in security.
Why?
Because, uh, now every, uh, area you take right from, you know, the, uh, you take it from a
federal or government offices to you take any business entities without security, no one is able to
survive.
Okay?
Even if you take it a simple, you know, a small startup company, okay, they have created some product.
And once if they release that product, if there is any security bug, okay.
And they have say, for example, they invested, say with $1 million, they have invested a small,
small startup, but all of a sudden they found like the product is really very good and the solution
is excellent.
Okay?
And they are really tackling a problem.
But the problem is there is a vulnerability means a weakness in that particular application because
of that.
Okay.
If someone exploits that weakness and they are going to lose the reputation of that company and you
can say like like immediately that people will think about that, okay, we use that product, okay,
Then there will be some kind of, you know, like insecurity for us.
Like once we put some data or even though they fix that security issues, but still people doesn't even
show up.
Any interest in those company means that company is gone forever.
Okay, so it happened with so many, uh, I think so many people might have used Equifax where they
were storing lot of their personal data over there.
Okay, so it got exploited.
And now no more Equifax company is there.
If you see Sony.
Okay, just abusing like, you know, just a comment or a movie, which they have done it on.
Uh, you know, like some, some company mean country.
So the nation bad, I mean, like some rogue nations they have actually entered into like hacked into
the Sony systems and they completely destroyed you know, they, they exposed the customer and the employees
information and also their intellectual property kind of their own movies.
Okay.
Which they have done.
They brought them out and kept it in the public space, which has to get released some movies and which
which not.
Not at it got released.
Those movies also, they have kept it in the public domain.
And as well as like, you know, you and yours and my data means like public data as well.
They have kept it outside.
Okay.
And also their employees information also.
So this is very bad.
I mean, like, you know, like it's not a small thing.
It's something very serious because, uh, how many of you think that your personal data is safe?
How how much secure?
No, it is not at all secure, to be frank.
Security is just, you know, the the the instinct of everyone that how much data you have to put in
your, you know, mobile.
Okay.
And how how secure it is and where you are putting the data that is also.
So the company started thinking of okay, this happens to me, then it will be a big problem for me.
Even though they have very good security, you know, the the policies and procedures and apparatus,
apparatus in the sense of tools in place.
Companies like Sony, they are, you know, like not able to.
Uh, stop and attack from a rogue nation.
So that happens.
Okay, So you if you are having some appliance or procedures and policies, okay.
And your management is really good at, you know, tackling these kind of, you know, attacks as well.
But still.
Okay.
Attackers are a little one step, way ahead than you.
They'll be thinking of like, you know, in which way I can get into the system and in which way I can
grab, uh, you know, like some information or money or any, like, you know, making your systems
not usable.
How I can do that.
That way they'll be thinking.
So there are a lot of things happening around your, around you, but we are not aware.
And one thing I would like to tell you guys is you have chosen this path for a specific reason.
Okay?
Some one of your friends might have told you that this might be a very good career opportunity or someone
might have told you that, you know, like, uh, like as of now, there are more opportunities.
Okay.
Or someone has might have told you that there is no programming in it.
Okay.
So you can easily survive in this.
Okay, so whatever it is the case.
But for any security engineer, knowing the latest.
Okay, the the, the events that are happening around you is very important.
Okay.
So that you will be at least in par with the attackers.
Okay.
And you have to like, you know, like keep focusing on like, understanding where I can get the information.
Okay.
So some of them are like, you know, Paul, Security Weekly is like some YouTubers who are actually
sitting together.
And every day they discuss some 15, 20 minutes that security related events that are happening throughout
the world, the major security incidents that are happened or throughout the world, if a company is
coming up with some solutions that also they discuss, okay.
Or some security blogs also available, I'll be sharing those things with you guys.
But after some time.
But one thing I would like to tell you, whatever you are, requirement is okay.
My humble request is just even if you don't know anything, okay, you consider yourself that, okay,
I'm willing to learn this technology because, yeah, something good I'm going to do in the sense if
I join some company.
Yes.
Money, you will get definitely 100%.
But before too that.
Yeah.
I'm in a field where I'm defending something that is from a bad actor.
Okay.
If you are a programmer, yeah.
You are serving a purpose.
Okay.
That there is some, you know, like requirement is there you are building it.
Okay.
There is some requirement.
You are building it, but you are a defender in the sense your role is like a firefighter.
Your role is like a police officer.
Okay, That kind of role you have you you get a lot of respect compared to other people.
That's 100%.
I can write it and give it to you.
If someone says that you are a cyber security expert, the way they treat you in any, you know, the
the the the world, it's totally different than any programmer or any operational sites, people who
are working there.
Right.
So this thing please keep it in mind.
Okay.
So for that do you require.
If, you know, like a degree with mean like a lot of, you know, the badgers, like, you know, you
should be a programmer.
Yeah.
No, not that.
Okay.
The instinct.
Okay.
Of an attacker.
How?
How he thinks, Right.
The same thing.
You should slowly adapt and try to defend your organization.
That in a step wise, we will be going to learn throughout this course.
Okay.
Is it not possible that for anyone to learn it?
It is possible for everyone to learn it.
But the thing here is like how you how much you are going to put your or invest your, you know, the,
you know, effort in this particular like journey.
It all depends upon you.
Okay.
So there are two categories here.
Okay.
People who are defending an organization.
Okay.
Some of them are called, as you know, the red team, people who are actually trying to like identify
what are the bugs in our organization means like weaknesses in our organization.
Okay.
If they identify something, okay, we are ready to provide some solution for it, like how we can like,
you know, or the save the company from those kind of weaknesses or attacks.
Okay.
So I can give you one real time example as of now.
See, the coronavirus is one.
You know, as of now, we are in a pandemic situation.
You are more, more vulnerable.
If you go outside, you there might be a chance of you getting infected with this Covid virus.
Okay.
So for that, what you have to do, okay, you have done all the precautions.
Like you are wearing the mask as soon as when you come out.
Okay.
You are just washing your hands properly and you know, you are doing all the sanitizing your hands
properly and you are doing everything from your side.
Okay.
But unfortunate things happens.
That means some during some vulnerability, maybe you might have touched somewhere and after you're
washing it or before that or after that, something you have touched somewhere.
Okay.
Because of that, you got Covid.
Okay, now people are there.
Okay.
Who are actually trying to like you are going to get infected.
Okay.
And it is not 100% guaranteed that you might survive or you might not survive the same thing.
That attack happens.
Your company might survive or your company might not survive.
Okay.
But it won't be like the same as EAS, like yesterday.
Once after the attack happens, you the company will lose its reputation, money, or some other thing.
Same way you might like your health, like you might be losing your, you know, um, like your, your
immunity to certain extent.
Okay.
It might take a year or it might take six months or it might, you might get recalled within ten days
itself, but you are going to lose something.
Okay.
So what is the thing is required now?
Okay.
If you are not got infected, let us make our systems more immune by taking the vaccines.
Okay.
So we we have used some mean like, you know, the things like in our offices also example like like
wearing a mask for you it's kind of like firewall have.
Okay.
Is it going to stop the attackers?
Yes, to a certain extent.
But if I have something like even though if enters if some virus enters into my body, someone is monitoring
inside as well.
That is the kind of like if someone like even I use a mask, but virus gets in, enters into my body,
but someone is monitoring that is like, you know, like vaccine is there in your body and it starts
as soon as it identifies it, it stops spreading that virus.
The vaccines main role is to stop it.
Okay.
So the same way security operations center, even though you have our cyber security analyst main task,
our security operations center analyst main task is whether it is going to come or it's already inside.
Okay.
I am well prepared with everything.
Whatever.
If something comes into my organization, organization, something very bad.
Okay.
I am going to stop it for that.
I'll be keep monitoring how you are going to do that.
If you take it as a virus all the time, something coming in.
Okay.
The genome signature is there, like, okay, when something comes, if this pattern is there, you
know, we have seen that Covid virus, you know.
You know, this Covid virus, how it looks and all some patterns you are actually told attacker will
be like having this kind of things, this kind of things.
Okay.
It will be having some tentacles means like our layman way.
I'm just telling I'm not any medical expert or anything.
I'm just giving.
Okay.
When this things gets if I see it.
Okay.
Definitely my.
Antibodies mean like my antibodies which are there, the the agonist, this Covid, the vaccine, I
mean, like which are injected through this Covid vaccines, they will go and see this pattern and they
will immediately stop attacking those cells and they will kill them, making your body immune to it.
Same way, we will also will be creating some kind of some rules and some rules which are very easy
to create.
Don't think it is something very difficult in even in security like you are going to create by end of
the course such kind of rules that if you find something, okay, you are going to take certain procedure
that, Oh, this is nothing but something kind of, you know, attack, you know, and I'm going to
stop it, okay?
That's all we do.
We are not going to do anything if you have this much.
You know, the willingness.
Okay.
I want to learn these kind of thing.
Yeah, This is the right thing for you.
Okay.
And as I'm telling nothing else beyond this, it's like.
Applicable for anything.
You know, like if you are in a small organization or a very big organization or it might be, you know,
um, uh, a mid-tier organization.
Okay.
I'm currently working in a financial institute.
Okay.
It's, you know, the number one financial institute in us.
Okay.
I'm seeing with my naked eyes what kind of attacks.
They are coming every day because people try to abuse the systems in a way that, okay, somehow they
want to get into the system.
They want to.
Okay.
Try to, uh, you know, the damage, the reputation or financial or the, you know, the the services
to be stopped or these kind of things they will be trying to do.
Our main job is to stop it at or defend our organization.
Forget about the stopping and all at least identifying or defending that kind of kind of attacks.
Okay.
So with this note, I just want to tell you guys like, you know, uh, I would like to hear what kind
of expectations you guys have.
Okay, so now let's discuss about the course curriculum.
That's fantastic.
Someone asked a nice question.
Let's proceed with that.
Okay.
So, guys, for everyone, even for you or for me, we don't know anything.
As of now, that's the open mind we should be having.
Okay, so first, let's start with a baby steps.
Okay.
In the sense what's first the computer is all about?
Okay.
What is what is this memory?
What is this processor that kind of things I'll be explaining for some time.
And then after that we'll get into this real, uh, this course content.
Okay.
In that first what you'll be doing is we'll be learning about like how the computers will communicate.
That is one computer to another computer, how the communication happens.
We'll invest some time in that once after we get to know about that.
Okay.
Someone is sitting somewhere and we have our office infrastructure, our home infrastructure somewhere
here.
Okay?
And when I send google.com or something, request from here or from my office, how I'm getting it.
Okay.
If someone if I'm a company, someone is asking like Amazon.com, I'm Amazon.com.
If someone is sending Amazon.com, okay, then it is coming to me as a company.
The request and how I'm processing it.
Those things we are going to learn at the beginning.
Because without that, okay, because everything is all business only, right?
End of the day.
Okay.
Wherever you go for any job, definitely.
That's a business.
Okay?
Without understanding and understanding the underlying, the the main use case, how it functions,
it's very hard for us to, you know, like you can say that you are a security first.
We learn them.
Okay.
There are some these things might look something weird for you as of now, but nothing to worry.
Okay.
All these things are covered too extensively.
And for your knowledge, if I'm covering like half an hour means for you to understand it.
One hour of topic.
Topic is already there in the YouTube.
I have kept it aside for you to understand more, but that doesn't mean that no one is stopping you
to asking the doubts.
Or here.
Definitely you can ask your doubts any point of time.
Okay, so we are going to first understand what is happening or the communication in between multiple
computer, how it happens and how they identify each other.
So those like two computers, if they are communicating, are the two systems.
They are like one in within to same office or like somewhere in some other company and at your home
how they are able to because you are just entering w-w-w dot google.com and you are clicking it somehow.
If internet is there then only you are able to see the webpage.
If no internet, no web page, correct.
Right.
Then only you are able to see how it is possible.
Okay.
Because they are identified as you know, the the machines are identified or this request come from.
Mr..
Raghav This request has come from, you know, Nandini this request has come from Srikanth.
Okay?
So I have to respond to him.
So that kind of we have the naming convention, what they have.
Okay, those things we are going to learn.
Okay.
And.
Like in an office.
If you say like I say like, okay, um, you know, uh, love is there.
Love is like, actually logged in from USA.
Okay, so now, um, I say like, there is multiple people are from, you know, from the states.
That's what I'm telling you now.
Okay?
That means I group like, set of people of some country.
Okay.
As like people from USA.
So that kind of, you know, uh.
Unit groupings will be there in an organization.
Okay.
That is called, as you know, different types or classes of IP address.
So those things are also we are going to learn.
Okay.
And also like, you know, some part like, you know, how the communication when we are going to use
some protocols will be there.
Like when I say when I'm using web browser, it uses some rules and regulations and gets the web page.
When I'm using, you know, my voice data is going to, you know, and you are able to listen to my
voice data.
So it is also using some protocol.
So what is that protocol?
Okay.
And there is some kind of you know, you will send some file to me.
Okay.
That time.
What protocol?
I'll be downloading that file.
Okay.
So what protocol?
It will be used.
So those kind of protocols related thing we are going to learn looking at these names.
Don't get confused or don't get scared.
Okay?
Nothing to worry.
All these are very simple because you might be knowing earlier, you know, the fancy, you know, the
like 40 years, 50 years before, you know, the the the when the Internet started to getting evolved.
Okay.
So they have like given these names.
Okay.
But every protocol this means you use a datagram protocol.
ICMP means Internet control, message protocol.
Okay.
So these protocols are very one single line of use case only.
Nothing to worry those things you will learn step by step by you know, next two weeks you will be familiarized
with familiar with all these protocols.
Also you need not to worry about them.
Then after that we learn the protocols.
Okay.
We'll be learning some some sort of, you know, attacks, services.
Okay.
Services in the sense like you are logging into my machine, you know, in your office.
Okay.
You are actually connecting to the Wi-Fi.
Okay.
That is also service.
Okay.
Um, you are using the web.
Web web access that is also on service.
Okay.
You are using.
You know, um, what I can say, uh, web like my domain name is here.
How it is working.
I am not talking how the data is coming, but how my browser is going to understand that.
Okay.
Uh, this particular e-learning infosec is there that in some location.
Okay.
And then, uh, like, how I can reach that location.
Okay.
That underlying protocol will be these things are very early for you guys, but I'm just telling you.
So like, services means like, I'm talking to you.
That is called as what?
Why?
Server service.
Okay, I'm browsing.
That is web browsing service.
Okay.
Um, why I'm able to access to the.
Internet here.
That is Internet service.
These are nothing but using some protocols.
We are going to get these services, how they are working that thing.
Also we are going to learn means like protocol used for some services.
What are first we will understand the protocols and then we will understand the services also.
Okay, so domain name service.
Dhcp service means like like getting the IP address to your machine, your whether it your home or office,
how it happens, Http service, how your web browser is getting the data.
All those things will be.
And then we are going to get into like once you got like basic understanding on um, like, uh, networking
and some protocol knowledge you are very good at now, a foundation level to such an extent that now
slowly you can start baby steps into the cyber security.
In this cyber security, I'll be explaining theoretically some concepts for you.
No need to have any practical experience here because we are not any red team guys.
We are blue team guys.
Yes, I have created some videos, uh, separately for the people who are interested who are having
interest in this particular area, um, where they want to even learn those attacking related things.
I will refer you those videos.
Okay.
So the attack cyber attacks related things will be learning.
And then this is for understanding what kind of attacks they might do.
Okay.
Just for that reason.
And then once after you, you know, the attacks.
Okay, then we'll be like, okay, in our offices.
Okay.
There are so many attacks we'll be learning in our offices, mainly what kind of, you know, things
which will be happening.
Those things also we are going to learn.
And one more thing I would like to tell you guys.
I have created these as sections, but we are not like starting this concept.
Not like this concept, no wrapping up multiple concepts in one single as a use case will be discussing
in that way.
Okay.
When I say like some topic in the sense it will be kind of story in the story, then we'll say, Oh,
this thing is called as DNS.
This thing is called as Http.
Okay.
This thing the is called, as you know, uh, Dhcp.
That way we are going to explain.
Okay, Don't think that this, this topic hasn't covered this topic has.
Yeah.
That we will do it once after everything gets finished of that particular module.
Okay.
Now then after that some, you know like the major attacks related thing, we will see like majorly
like you know companies will get affected with the and one more thing I'll be making sure you are able
to understand like what is different kinds of logs what kind of logs we'll be using see company means
if you see any company you might have heard about, like they will be using Windows Server, they'll
be using Linux server, they might be using some firewall, they might be using proxy, they might be
using some, you know, the antivirus.
Okay.
Every system has got its own job to do.
Okay.
But.
There is one small line I would like to mention over here.
That is if everything is happening or there.
As a matter of fact, like every action that is performed okay on that particular server or on that
particular machine, even in my machine as also now, as of now, whatever I'm doing is getting recorded.
Recorded as an event means this guy has actually now launched Zoom.
This guy has actually launched, you know, the network settings.
See if I say properties, that is like I have opened the network settings.
Okay?
So every action I'm doing is getting recorded as an event example when you go to the office, okay,
forget about it.
Whether it is an or not, what you do, you swipe in, correct?
Right in the morning.
Okay.
It gets recorded in their system that it is an event that so-and-so person has entered into the organization.
But for what purpose?
It is okay.
It is for you to allow to enter into that organization or into a store or into a specific workplace
where you work.
Okay.
The main purpose is whether to allow you or not, but that is getting recorded where in a system.
Okay, if someone does investigation.
Okay.
Hey, boss, what time you have come to the office?
You see that I have come at 10:00.
Or is it?
So let me go and see in the system.
Okay.
Then they will go and see it.
Oh, you said you come at.
You have come at 10 a.m. but my record shows you have come at 1030.
Okay.
So recording means like the event, whatever it happened.
Okay.
Just it creates a line of, you know, information that Mr. Raghu has entered into the office at this
particular gate at this particular time.
These are very important for us as a cyber security analyst.
With this information only, we are going to identify the person who is entered in is an attacker or
non attacker.
This thing we are going to put a lot of focus.
We are going to learn how a firewall is going to record such kind of things, how a Windows system is
going to record such kind of things, how Linux machine is going to record such kind of example is okay.
I would like to say if I enter.
amazon.com from my machine.
If I click enter, I will write it and give it to you 100% that.
Then my request went to the Amazon.
Okay.
It created a line of, you know, the entries.
One when it went entered into their organization in their firewall.
My activity means so and so person, so and so person from so and so location somewhere from India has
actually entered into them that is got recorded.
And the request where it will go from in the office, from firewall, then it will get into the web
server where this web page is present.
And in that particular web page, okay, we will be pulling and showing it right, the Web page, the
request, our request will go to that Web server, Web server before it serves that request, it will
understand it.
Oh, you want Amazon.com?
Okay.
I'm providing you that web page to you now.
You can show it on your, you know, the browser.
So as soon as it serves my request and sends the web page immediately, it records an event there that
sometime before Mr. Raghu has come with her has come from so-and-so IP address or location.
Okay.
And he asked me to provide Amazon.com web page.
Okay.
I have provided him successfully that kind of record.
One line will be there that is useful for us as a security analyst, and that is the only core concept,
the core part for us, nothing else is required.
We are going to understand, okay, the functionality of what a web server does, what a firewall does,
what a antivirus you know, software does, all these things we are going to learn, okay, but we are
not going to use them.
But what we will do, we are going to use the logs those machines have created.
Okay?
Those machines creates like I have done this task now.
Okay, I'm going to record it.
I have done like I'm allowed some person to enter into our office.
That's what Firewall does.
Okay, So I'll be recording it.
So those records is important.
These are all called as events.
Okay.
We are more focused on events.
Okay.
So to, uh, to be frank, what kind of logs predominantly will be focusing is we'll be focusing on
Windows logs means like Windows system.
Okay.
Nothing to worry.
I will make you understand everything in a simplest way.
Okay.
Linux logs.
Okay, then.
Firewall logs.
Web server logs.
Okay.
Um.
It means like, I'll explain you what is intruder detection system and some threat is there then to
identify it.
It's kind of like, you know, security system, like antivirus itself, but it works in a different
way.
Then antivirus like these are like normal antiviruses like, you know, you are not an antivirus.
You are, you know, the semantic antivirus, sorry, semantic antivirus.
You have Kaspersky, you have, you know, Sophos, you have McAfee.
So many things are there, right?
Those softwares are itself like, hey, boss have identified one.
You know, like I just identified a malware on this system.
Okay.
Then just record it as an event.
Got it.
Right.
Okay.
And.
We are going to talk.
Tim is going to pull that lines continuously that see anywhere that malware is actually happened or
not.
No need to, you know, like for you to understand how to install antivirus, how it works inside in
a programmatic way.
Nothing is required.
The log says, okay, that on this particular machine, at this particular amount of time there is some
anti I mean like malware attack happened.
Okay.
So we are going to use this logs and immediately we will follow certain steps and procedures and we'll
take care of like defending that machine not to get impacted or stop spreading the impact of that particular
incident.
Okay.
So that is the thing.
Antivirus logs.
Okay.
And.
You know Microsoft.
Okay.
Um.
Microsoft.
Okay.
Web servers is also there.
This comes here itself.
Okay.
Here itself.
It will come.
Okay.
Office 360.
Like complete Microsoft related entire whatever it happens in the offices.
Right.
Okay.
Someone has actually opened mean received a mail someone has actually created launched some excel and
updated it to some OneDrive.
OneDrive means some software where entire files in an office which is like, you know, um.
Like this is office.
Like you are a X access or Excel or, you know, OneNote or Outlook or PowerPoint.
These things, you can store it in some location that is called as OneDrive.
Okay.
In the in the office premises itself.
And these are all managed by single software that is called as Office 360.
Those logs are also we are going to monitor.
Okay.
So these are like few.
I am just naming it.
Okay.
But to be frank will be like, you know, uh, these things itself for more than sufficient for our
training stuff.
Because once if you learn Windows and Linux you can like any variants of any other window.
I mean, like all the variants of Windows machines, all the variants of the Linux machines, you can
easily understand when I say web server, whether it can be there are multiple web servers, are there
like Apache IIS?
Don't get confused.
Okay?
In Jinx, all these comes under, like, web servers.
Okay?
All these variants, you can easily you can understand ideas.
Same thing.
Antivirus once if you understand one antivirus like you know.
Um.
I will be using semantic.
Semantic.
So it's easy for you to easily understand how McAfee locks also looks.
McAfee or Sophos because the functionality of it is the same.
Okay, so once if you know like how one software works, it's not very big deal that another software
also from different vendor how it works.
Okay same thing only it will be doing so.
Locks also looks the same.
Almost.
Just maybe the fear.
Like it might have explained the one lock.
What it generates is Mr. Rago has logged in from this machine.
Okay.
And actually try to open this particular file.
Okay.
Instead of that, Mr. Rago has logged in from this machine.
From this machine.
Mr. Rago has logged in and did and launched this particular file that kind of like here and there.
Pickings will be there.
Nothing much.
Okay, so this is about like, you know, what kind of logs you are going to.
I don't want to get too much into deeper into what all we are going to logs you are going to learn as
of now.
So but you are going to learn a lot of logs related things.
Okay.
Um, so these attacks I'll be covering like during whatever I'm covering here itself, right that time,
only I'm covering all these attacks as well.
And uh, this web application related things before to this only we will be covering web application
related things.
And uh, because that helps us to understand more about the attacks related things very, uh, you know,
properly, like, you know, what is how the web applications works.
So now the attacks you can easily understand.
So just curated in a way that, okay, that all these topics will cover.
But first we will understand the basics first and then, uh, we will be understanding the other parts
later.
So, um, as a whole, uh, once after doing that, we'll be doing all the real time stuff.
Okay.
Real time.
Real time stuff in the sense like I'll be giving you, um, set of logs to you guys which are like,
you know, the real time attack logs.
Okay.
Means, um, some, you know, like some security researchers have actually collaboratively, um, collected
the logs from, you know, pretending to be some people as attackers and some people are defending,
okay, like firewalls they have kept they created a simulated environment of, you know, uh, an organization
and they did some attacks and they captured and they and in that organization, they have like firewall.
Is there is there you know, the antivirus is there, Microsoft servers are there, Linux servers are
everything.
Is there a copy of those logs?
They have captured it and they have shared it across in the Internet.
Those logs we are using for our training purpose because.
You are going to learn what is good, how an in an organization, how a good traffic looks so that you
will be knowing that what is the bad traffic.
First we'll be learning good what is good, and then we'll be learning how a bad things looks.
So in that particular logs, good logs are also there means attacker logs are also there so that it
will be very useful for your training purpose.
Okay.
Real time training purpose.
Okay.
So with that we'll be going to wrapping up the course.
Okay.
The Real Time Project will be containing, you know, like so many dashboards, like so many some attackers
comes what are the, you know, like defending things you have created in your organization that identifies
those attacks.
So those things by that time since you know that okay how you will do that means like you might by the
time uh, yeah, by the time when you start learning you you'll start with network basics.
Okay, then.
Once.
If you understand the network basics, then I'll be explaining you security basics.
Okay.
What is this encryption?
People are telling first waterfall the security.
What is meant by this encryption?
Sometimes my browser doesn't allow me to access some websites telling that it is not secure.
What is the reason?
Okay, so those kind of things are we are going to learn in the security basics, okay?
Like cryptography is what what is meant by encryption, what is meant by hashing all those things we
are going to learn in that particular.
So then after that attacks.
In the network basics, not only like protocols, but also web related stuff, how it works and everything
will be covered.
So nothing to worry.
So after that, only we are going to cover the security.
Then after that attacks how a web server gets attacked, how a network gets attacked, all those things
we are going to learn then after that.
Okay, then I'll be giving you the cyber security.
Analyst role.
Introduction.
Now you have all the weapons required apparatus required for to defend.
So now what?
And all you can do.
I will explain that.
Okay, then after that.
Okay, Now we will use tools.
Okay to defend.
Okay.
Tools means here.
SIM.
That is not sim.
I can say it is a as I know you know you are an analyst now.
Okay.
You are working some on logs.
That is meant by data.
So with this particular logs, you know the analytical software.
That is Splunk Software.
How you can identify the threats in your organization.
You are going to learn.
And I would like to say there is a bridge in between these two.
That is called as logs.
I don't put it as a category that doesn't belong here.
This below one.
It doesn't belong here.
Okay.
Because you are going to know these logs only when you have this knowledge.
And without the logs you are not going to do anything over here.
So this is very, very important thing.
Okay.
That is the first thing you have to remember.
Okay.
So once if you understand the logs, these here, like as I said, all these logs, you are going to
learn at this particular phase.
Okay?
At this particular phase.
Now, these two tools, tools in the sense only Splunk we are going to discuss.
Okay.
And I'll be showing you some other tools like within the Splunk, some tools how you can install all
those things.
I'll explain.
Easy way.
Okay.
Um, then after that, Okay, learning the tool and then implementing the.
Okay.
You know, like.
Some solutions in the tool.
Like.
Today morning.
Okay.
All of a sudden, usually my web server will be having 100 users will come.
Okay.
Uh, for serving.
But today morning, I have observed 120 users have come 20% increase within last five minutes.
Example.
Okay.
That could be a reason of an attack.
Who knows?
Or.
Like, you know, that your employees will be working right from morning, 9:00 to evening, 5:00.
Okay.
Anything false from one is logging into the systems after 5:00.
It's very rare situation and something it is an anomaly of some suspicious suspicious activity.
So I'll be looking at the logs of my windows.
Machines are my machines that if any, someone has actually entered into the office at 10:00 and they
tried to 10 p.m. and they tried to log into the system immediately.
I would like to catch such kind of events.
Okay.
So for that, how you are going to write the.
You know, like, you know, the queries.
Queries.
This is some kind of, uh, what I can say some kind of, uh, uh.
Utility for identifying such kind of attack activity in the logs.
Okay.
So how you are going to identify that, those kind of things also we are going to discuss.
Okay.
So then after you implement it.
Then what you are going to do.
You are going to.
Prepare.
For.
Okay.
Prepare for your job.
Okay.
Why am not saying here in interview I'm telling you about the prepare preparing for the job because
I would like to tell you one one thing.
When you are finishing the network basics interview questions will be completed.
Before we go to the next step, that will make sure.
By the time you finish the last topic.
You are already ready for getting into the job.
Okay means like you are ready, but you are just preparing yourself like more understanding, like once
after you might crack some interview.
Okay, so they might ask this kind of solution in the organization where I go, they might ask to implement
me this kind of solution.
So those kind of thought process only you should be thinking not like what questions they might ask.
Will they ask me this question?
Will they ask me What is the difference in between TCP and UDP?
Will they ask me any question on, you know, what is meant by, you know, encryption?
Will they ask me about how the Google works?
No, no, no.
All those things you should finish today.
I have finished.
One topic means interview questions related to that topic has to be finished means today means today.
Tomorrow.
If I finish some topic means interview questions related to that particular topic should be finished
by that week itself.
No more dragging.
Okay.
So that every one of you will be in a confident that.
Okay, even though I missed some concept not understood, I have a week of time where I'll be, you
know, like recapping them.
And if I have any doubts, I'll be reaching back to my trainer in the weekdays.
If it is some ten, 15 minutes of time it takes, I will get it clarified before I come to the next
class itself.
All the interview questions which my inter my trainer has shared.
I am well versed with them and I'm confident if someone comes up with some interview planned for any
network engineer, I'm ready to face them as well.
That way you should be prepared and that way I'll be preparing you guys.
Got it.
Okay, so the interview questions will be there at each and every phase.
You are going to prepare my role.
My main motto is not to make you, not to make you guys to crack the interview.
The day when you get into any office.
You should not fear about how you perform the job.
Like I have just cracked the interview.
These are all real time things, right?
How I have to survive.
No, no, no, no.
That is not our thing.
By the time you finish the course, you are well-versed with hands on.
Also, you should thinking these guys have got these solutions.
What best I can provide to these guys.
That is the sort of mindset you should be having, as if like you had some experience at your back and
you are just came over to some other, you know, the organization.
To make their company more safer.
That should be your main motto.
Okay.
And I would like to tell you one more thing.
Okay.
There are, you know, like some.
I can say that, uh.
Some roles in cyber security.
Also, administrator roles will be there and the analyst role will be there.
Administrators are, you know, the people who installs the software and helps us to, you know, like
to analyze the logs in a better way.
Okay.
And analysts, we are actually the guys who are having the security knowledge and who are going to,
you know, find the real we are the people who are defending the organization.
Okay.
But administration administrators are helping.
But if someone tells like, you know, I'm I'm learning Splunk means no, you are not learning administration
administrator.
Okay.
Because whatever you are going to learn the next company where you go you might find some other tool
say for example, instead of Splunk, you might be encountering, you know, the Qradar or you might
be encountering, you know, what it is.
ArcSight Or you might be encountering McAfee or Logarithm or Norton, whichever the Siem tool they provide.
Okay.
You are least bothered about those tools at all now because you are well versed with the logs, irrespective
of the tools you give, you will tell your boss I don't have any issue.
Okay.
Just give me the of the tool.
That's it for one week.
Your boss will be very much confident in you that okay.
I will provide you the tool knowledge then.
Now I will write it and give it to you.
You are 100% better than mean.
Like.
Like you might be 100% better than the people who are already working there because the the the kind
of, you know, the approach you, what you follow with the basics.
Right.
And then understand the logs.
Right.
Okay.
It is like you might have not come across anywhere or how to understand those logs compared to others
who have already working also.
Okay.
That way we are going to learn it.
So nothing to worry about your like after interview preparation.
I should be thinking about like after like finishing my course.
I should be thinking about the placements.
I know nothing.
Okay.
You are getting prepared from the day one itself.
Okay.
By the time when you finish the course, you are thinking about the upcoming job role and how you are
going to improve that organization.
That's it.
No more interview related discussions with us.
Okay.
So this is the part of, you know, like the curriculum and what you are going to learn and all the
real time logs which you use and you create some you implement solutions like dashboards, alerts,
reports, how you are going to do like this entire last week.
These are the attacks that happened in our organization.
This is how our server firewall has performed.
Okay?
This is how our, you know, the the traffic patterns for there for the entire week on our web server.
Okay.
Attack patterns of the traffic in our web server.
So those kind of reports how you are going to provide.
Okay so those things how you can create all those things you are going to learn them here.
Okay.
So for everything basis, the logs, which is very, very, very important to understand the logs basics
is important.
Once if you finish this, this the hard part.
It is not the hard part.
It is the cake walk then got it right.
This is a cake walk.
So put your more efforts here.
Okay.
Then it will be a cake walk here.
Okay.
And one more thing, guys.
Important thing.
Okay.
Um.
Whether you are looking for, you know, uh, uh, you know, the, the roles, whether it is in us
or in India.
Okay.
Or in Middle East.
Some people have joined, right?
So from whichever the location you are from.
Okay.
The roles and responsibilities of SOC engineer is the same, but there might be a change in the timings
or the shifts.
Okay.
If you are working in us, US majority of you guys will get an opportunity to, uh, you know, the,
the if you are in US location itself, you have an opportunity to work in the daytime itself.
But, but whereas in for the people who are in India, mostly they will start their activities after
12:00 in the, in India time till 7 or 8:00 or something, uh, in India time.
Okay.
Because prior to that it will be like, you know, uh, uh, 24 hours of security related majority of
the part will be like Singapore and other locations.
They will be taking care.
Okay, So this kind of timings means like, from my experience, most of the times I have, I had this
slot.
Okay?
So that is the thing.
And it is not stick to, you know, once if you learn you are not only a SOC engineer, but you are
a cyber security analyst role where any team in in the organization, if they want you to hire as a
security adviser, they will be hiring that.
Those are also lot of times which I have said.
So let me show the, uh, cyber.
Okay.
Cool socket and a list.
Okay, let's go to the Google jobs, which consolidates us and gives us everything.
Okay, so nothing to worry, right?
From freshers to the experienced people, the companies are wide range like Capgemini, PwC, IBM.
Okay.
Everyone needs security as part of their integral part of their organisation.
Okay, so without security even, they don't survive.
Okay, I will tell one more thing.
Even this, you know, the these kind of situations, they need more security engineers to help them
to secure because a lot of bad actors are now ran out of the you know like the business and they want
some money.
So the active business is happening only on the Internet.
Right.
So these bad actors, they turn towards the the online, the businesses and they will start abusing
them.
Maybe another one year situation.
It will be like this, I guess.
Okay.
So where people are not at 100% coming out.
Right.
So more activity on the Internet itself.
So the opportunities will be there all the time.
But now a lot of requirements are there for security.
If you know the stuff that we are going to discuss.
Right.
To certain extent, also they are ready to take you that kind of requirements are there.
Okay.
So these are like, you know, some companies which are taking the I mean, like these many companies
are there just I would like to give you some heads up.
And if you see the roles like, as I said, like Active Directory Antivirus and some kind of tools like
Windows and Linux logs related, majority of the things is like the events from various sources like
intrusion detection system, firewall logs, system logs, all these things you are going to learn if
you take any job here.
Okay.
If you take any job here, the primary role for any candidate is to look into the logs, any to take
anything.
Okay.
The logs.
Okay.
Oh, sorry.
Okay.
I don't think.
Just give me a second.
So on these particular devices as an engineer, how you're going to provide solutions for them that
only they are going to ask you.
They are not going to ask you, will you develop me a program or this kind of thing?
In this particular role, no programming related questions.
Maybe provide me some kind of, you know, pseudo thing, how you can solve this puzzle or how you can.
I mean, if it is a company like, you know, a port based company, they might ask, But apart from
that, nothing.
Okay.
So even every company, right from Microsoft to everyone requires a SOC analyst.
Security analyst.
So nothing to worry.
Okay.
So and I can assure you that if you are getting trained from me, um, you are in the right hands.
Nothing to worry about that as well.
Okay.
So with all this, you know, let's take a break.
Uh, and before too, that I'll.
I'm ready to accept any questions from your side.