[{"id":"76654","title":"Overview","description":"

This module introduces the audience, prerequisites, and agenda for the course.

","steps":[{"id":"529127","prompt":null,"isOptional":true,"activities":[{"id":"521976","href":"/paths/1547/course_sessions/27820787/video/521976","isLocked":false,"duration":279000,"title":"Course overview","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false}],"expanded":false},{"id":"76655","title":"GDC platform overview","description":"

This module provides an introduction to the Google Distributed Cloud (GDC) platform. It begins with a general overview of the platform and its services, then delves into the roles and responsibilities of GDC users. The module also explores the two operating models for GDC (customer-operated and Google-operated) and provides a high-level look at the GDC architecture design, emphasizing its security features. Finally, it introduces the Operations Center (OC) as the central hub for security operations.

","steps":[{"id":"529128","prompt":null,"isOptional":true,"activities":[{"id":"521977","href":"/paths/1547/course_sessions/27820787/video/521977","isLocked":false,"duration":61000,"title":"Module overview","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529129","prompt":null,"isOptional":true,"activities":[{"id":"521978","href":"/paths/1547/course_sessions/27820787/video/521978","isLocked":false,"duration":277000,"title":"What is GDC","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529130","prompt":null,"isOptional":true,"activities":[{"id":"521979","href":"/paths/1547/course_sessions/27820787/video/521979","isLocked":false,"duration":327000,"title":"GDC services","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529131","prompt":null,"isOptional":true,"activities":[{"id":"521980","href":"/paths/1547/course_sessions/27820787/video/521980","isLocked":false,"duration":75000,"title":"GDC at Cymbal Federal","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529132","prompt":null,"isOptional":true,"activities":[{"id":"521981","href":"/paths/1547/course_sessions/27820787/video/521981","isLocked":false,"duration":340000,"title":"The users of GDC","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529133","prompt":null,"isOptional":true,"activities":[{"id":"521982","href":"/paths/1547/course_sessions/27820787/video/521982","isLocked":false,"duration":75000,"title":"The GDC operating model","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529134","prompt":null,"isOptional":true,"activities":[{"id":"521983","href":"/paths/1547/course_sessions/27820787/video/521983","isLocked":false,"duration":608000,"title":"GDC architecture","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529135","prompt":null,"isOptional":true,"activities":[{"id":"521984","href":"/paths/1547/course_sessions/27820787/video/521984","isLocked":false,"duration":462000,"title":"GDC security guarantees","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529136","prompt":null,"isOptional":true,"activities":[{"id":"521985","href":"/paths/1547/course_sessions/27820787/video/521985","isLocked":false,"duration":183000,"title":"The Operations Center (OC)","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529137","prompt":null,"isOptional":true,"activities":[{"id":"521986","href":"/paths/1547/course_sessions/27820787/video/521986","isLocked":false,"duration":41000,"title":"Module review","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529138","prompt":null,"isOptional":false,"activities":[{"id":"521987","href":"/paths/1547/course_sessions/27820787/quizzes/521987","isLocked":false,"duration":600000,"title":"Knowledge check","description":null,"type":"quiz","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false}],"expanded":false},{"id":"76656","title":"The infrastructure operator SecOps roles in GDC","description":"

This module introduces the Security Operations Center's (SOC) role within GDC. You'll learn about the SOC's core functions, operating principles, and its role in defending the GDC platform. The module will also cover Mandiant's security contributions, the responsibilities of different tiers of security analysts, and the contrast between reactive and proactive security measures. Finally, you'll examine a typical SOC organizational structure, the SOC manager's role, and how the SOC collaborates with other GDC teams.

","steps":[{"id":"529139","prompt":null,"isOptional":true,"activities":[{"id":"521988","href":"/paths/1547/course_sessions/27820787/video/521988","isLocked":false,"duration":55000,"title":"Module overview","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529140","prompt":null,"isOptional":true,"activities":[{"id":"521989","href":"/paths/1547/course_sessions/27820787/video/521989","isLocked":false,"duration":273000,"title":"The Security Operations Center (SOC)","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529141","prompt":null,"isOptional":true,"activities":[{"id":"521990","href":"/paths/1547/course_sessions/27820787/video/521990","isLocked":false,"duration":196000,"title":"Defending the GDC platform","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529142","prompt":null,"isOptional":true,"activities":[{"id":"521991","href":"/paths/1547/course_sessions/27820787/video/521991","isLocked":false,"duration":69000,"title":"Roles in the SOC","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529143","prompt":null,"isOptional":true,"activities":[{"id":"521992","href":"/paths/1547/course_sessions/27820787/video/521992","isLocked":false,"duration":239000,"title":"Tier 1 and Tier 2 analysts in the SOC","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529144","prompt":null,"isOptional":true,"activities":[{"id":"521993","href":"/paths/1547/course_sessions/27820787/video/521993","isLocked":false,"duration":169000,"title":"Tier 3 analysts in the SOC","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529145","prompt":null,"isOptional":true,"activities":[{"id":"521994","href":"/paths/1547/course_sessions/27820787/video/521994","isLocked":false,"duration":62000,"title":"Security and the SOC","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529146","prompt":null,"isOptional":true,"activities":[{"id":"521995","href":"/paths/1547/course_sessions/27820787/video/521995","isLocked":false,"duration":344000,"title":"SOC organization structure","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529147","prompt":null,"isOptional":true,"activities":[{"id":"521996","href":"/paths/1547/course_sessions/27820787/video/521996","isLocked":false,"duration":149000,"title":"Interacting with external teams","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529148","prompt":null,"isOptional":true,"activities":[{"id":"521997","href":"/paths/1547/course_sessions/27820787/video/521997","isLocked":false,"duration":47000,"title":"Module review","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529149","prompt":null,"isOptional":false,"activities":[{"id":"521998","href":"/paths/1547/course_sessions/27820787/quizzes/521998","isLocked":false,"duration":600000,"title":"Knowledge check","description":null,"type":"quiz","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false}],"expanded":false},{"id":"76657","title":"SOC processes in Google Distributed Cloud (GDC) air-gapped","description":"

This module provides an introduction to the security operations processes protecting the Google Distributed Cloud (GDC) platform. You'll learn about the central role of logs in SOC processes, the difference between manual and automated processes, and the importance of incident response plans. The module covers the three phases of incident response, the need for proactive cybersecurity, and introduces advanced security services like threat modeling and vulnerability management. This module lays the foundation for deeper exploration in subsequent modules and courses.

","steps":[{"id":"529150","prompt":null,"isOptional":true,"activities":[{"id":"521999","href":"/paths/1547/course_sessions/27820787/video/521999","isLocked":false,"duration":105000,"title":"Module overview","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529151","prompt":null,"isOptional":true,"activities":[{"id":"522000","href":"/paths/1547/course_sessions/27820787/video/522000","isLocked":false,"duration":249000,"title":"Logs in the GDC SOC","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529152","prompt":null,"isOptional":true,"activities":[{"id":"522001","href":"/paths/1547/course_sessions/27820787/video/522001","isLocked":false,"duration":72000,"title":"Manual and automated security processes","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529153","prompt":null,"isOptional":true,"activities":[{"id":"522002","href":"/paths/1547/course_sessions/27820787/video/522002","isLocked":false,"duration":244000,"title":"Security Information and Event Management (SIEM)","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529154","prompt":null,"isOptional":true,"activities":[{"id":"522003","href":"/paths/1547/course_sessions/27820787/video/522003","isLocked":false,"duration":240000,"title":"Security Orchestration, Automation, and Response (SOAR)","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529155","prompt":null,"isOptional":true,"activities":[{"id":"522004","href":"/paths/1547/course_sessions/27820787/video/522004","isLocked":false,"duration":302000,"title":"Endpoint Detection and Response (EDR)","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529156","prompt":null,"isOptional":true,"activities":[{"id":"522005","href":"/paths/1547/course_sessions/27820787/video/522005","isLocked":false,"duration":102000,"title":"SIEM, EDR, and SOAR at Cymbal Federal","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529157","prompt":null,"isOptional":true,"activities":[{"id":"522006","href":"/paths/1547/course_sessions/27820787/video/522006","isLocked":false,"duration":368000,"title":"An introduction to incident management","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529158","prompt":null,"isOptional":true,"activities":[{"id":"522007","href":"/paths/1547/course_sessions/27820787/video/522007","isLocked":false,"duration":410000,"title":"The activities behind incident management","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529159","prompt":null,"isOptional":true,"activities":[{"id":"522008","href":"/paths/1547/course_sessions/27820787/video/522008","isLocked":false,"duration":75000,"title":"The end-to-end incident response process","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529160","prompt":null,"isOptional":true,"activities":[{"id":"522009","href":"/paths/1547/course_sessions/27820787/video/522009","isLocked":false,"duration":167000,"title":"Monitor","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529161","prompt":null,"isOptional":true,"activities":[{"id":"522010","href":"/paths/1547/course_sessions/27820787/video/522010","isLocked":false,"duration":230000,"title":"Intake","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529162","prompt":null,"isOptional":true,"activities":[{"id":"522011","href":"/paths/1547/course_sessions/27820787/video/522011","isLocked":false,"duration":106000,"title":"Escalate","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529163","prompt":null,"isOptional":true,"activities":[{"id":"522012","href":"/paths/1547/course_sessions/27820787/video/522012","isLocked":false,"duration":260000,"title":"Investigate","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529164","prompt":null,"isOptional":true,"activities":[{"id":"522013","href":"/paths/1547/course_sessions/27820787/video/522013","isLocked":false,"duration":158000,"title":"Contain and remediate","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529165","prompt":null,"isOptional":true,"activities":[{"id":"522014","href":"/paths/1547/course_sessions/27820787/video/522014","isLocked":false,"duration":173000,"title":"Recover and report","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529166","prompt":null,"isOptional":true,"activities":[{"id":"522015","href":"/paths/1547/course_sessions/27820787/video/522015","isLocked":false,"duration":79000,"title":"Recap of incident response management","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529167","prompt":null,"isOptional":true,"activities":[{"id":"522016","href":"/paths/1547/course_sessions/27820787/video/522016","isLocked":false,"duration":95000,"title":"The incident response plan (IRP)","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529168","prompt":null,"isOptional":true,"activities":[{"id":"522017","href":"/paths/1547/course_sessions/27820787/video/522017","isLocked":false,"duration":243000,"title":"The challenges of proactive cyber security","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529169","prompt":null,"isOptional":true,"activities":[{"id":"522018","href":"/paths/1547/course_sessions/27820787/video/522018","isLocked":false,"duration":188000,"title":"Advanced security services in the SOC","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529170","prompt":null,"isOptional":true,"activities":[{"id":"522019","href":"/paths/1547/course_sessions/27820787/video/522019","isLocked":false,"duration":130000,"title":"Advanced security services at Cymbal Federal","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529171","prompt":null,"isOptional":true,"activities":[{"id":"522020","href":"/paths/1547/course_sessions/27820787/video/522020","isLocked":false,"duration":239000,"title":"The asset inventory","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529172","prompt":null,"isOptional":true,"activities":[{"id":"522021","href":"/paths/1547/course_sessions/27820787/video/522021","isLocked":false,"duration":342000,"title":"Introduction to threat modeling","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529173","prompt":null,"isOptional":true,"activities":[{"id":"522022","href":"/paths/1547/course_sessions/27820787/video/522022","isLocked":false,"duration":447000,"title":"Introduction to vulnerability management","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529174","prompt":null,"isOptional":true,"activities":[{"id":"522023","href":"/paths/1547/course_sessions/27820787/video/522023","isLocked":false,"duration":396000,"title":"Introduction to security engineering","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529175","prompt":null,"isOptional":true,"activities":[{"id":"522024","href":"/paths/1547/course_sessions/27820787/video/522024","isLocked":false,"duration":70000,"title":"Module review","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529176","prompt":null,"isOptional":false,"activities":[{"id":"522025","href":"/paths/1547/course_sessions/27820787/quizzes/522025","isLocked":false,"duration":1320000,"title":"Knowledge check","description":null,"type":"quiz","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false}],"expanded":false},{"id":"76658","title":"SOC tools for Google Distributed Cloud (GDC) air-gapped","description":"

This module introduces the SecOps tools used by security analysts to defend the GDC platform. You'll learn about Google's alignment with the MITRE ATT&CK framework and Mandiant's support for GDC SOC tooling. You'll gain a high-level overview of SOC tooling within the GDC architecture and explore key tools like Splunk SIEM, Grafana, and ServiceNow. The module focuses on introducing high-level concepts with a deeper dive into these tools in later courses.

","steps":[{"id":"529177","prompt":null,"isOptional":true,"activities":[{"id":"522026","href":"/paths/1547/course_sessions/27820787/video/522026","isLocked":false,"duration":70000,"title":"Module overview","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529178","prompt":null,"isOptional":true,"activities":[{"id":"522027","href":"/paths/1547/course_sessions/27820787/video/522027","isLocked":false,"duration":133000,"title":"Tools in the SOC","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529179","prompt":null,"isOptional":true,"activities":[{"id":"522028","href":"/paths/1547/course_sessions/27820787/video/522028","isLocked":false,"duration":221000,"title":"The MITRE ATT&CK framework","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529180","prompt":null,"isOptional":true,"activities":[{"id":"522029","href":"/paths/1547/course_sessions/27820787/video/522029","isLocked":false,"duration":90000,"title":"GDC platform security","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529181","prompt":null,"isOptional":true,"activities":[{"id":"522030","href":"/paths/1547/course_sessions/27820787/video/522030","isLocked":false,"duration":234000,"title":"Categories of tools for the GDC SOC","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529182","prompt":null,"isOptional":true,"activities":[{"id":"522031","href":"/paths/1547/course_sessions/27820787/video/522031","isLocked":false,"duration":239000,"title":"Core tools in the GDC SOC: Splunk SIEM","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529183","prompt":null,"isOptional":true,"activities":[{"id":"522032","href":"/paths/1547/course_sessions/27820787/video/522032","isLocked":false,"duration":240000,"title":"Core tools in the GDC SOC: Tenable Nessus","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529184","prompt":null,"isOptional":true,"activities":[{"id":"522033","href":"/paths/1547/course_sessions/27820787/video/522033","isLocked":false,"duration":279000,"title":"Core tools in the GDC SOC: Portswigger Burp","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529185","prompt":null,"isOptional":true,"activities":[{"id":"522034","href":"/paths/1547/course_sessions/27820787/video/522034","isLocked":false,"duration":382000,"title":"Core Tools in the GDC SOC: Trelix","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529186","prompt":null,"isOptional":true,"activities":[{"id":"522035","href":"/paths/1547/course_sessions/27820787/video/522035","isLocked":false,"duration":301000,"title":"Core tools in the GDC SOC: Microsoft Defender Antivirus and ClamAV","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529187","prompt":null,"isOptional":true,"activities":[{"id":"522036","href":"/paths/1547/course_sessions/27820787/video/522036","isLocked":false,"duration":192000,"title":"Core tools in the GDC SOC: Palo Alto","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529188","prompt":null,"isOptional":true,"activities":[{"id":"522037","href":"/paths/1547/course_sessions/27820787/video/522037","isLocked":false,"duration":90000,"title":"Observability tools in the GDC SOC","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529189","prompt":null,"isOptional":true,"activities":[{"id":"522038","href":"/paths/1547/course_sessions/27820787/video/522038","isLocked":false,"duration":178000,"title":"LogMon","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529190","prompt":null,"isOptional":true,"activities":[{"id":"522039","href":"/paths/1547/course_sessions/27820787/video/522039","isLocked":false,"duration":207000,"title":"The GDC observability ecosystem","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529191","prompt":null,"isOptional":true,"activities":[{"id":"522040","href":"/paths/1547/course_sessions/27820787/video/522040","isLocked":false,"duration":157000,"title":"Observability tools in the GDC SOC: Grafana","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529192","prompt":null,"isOptional":true,"activities":[{"id":"522041","href":"/paths/1547/course_sessions/27820787/video/522041","isLocked":false,"duration":209000,"title":"The query creation process in Grafana","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529193","prompt":null,"isOptional":true,"activities":[{"id":"522042","href":"/paths/1547/course_sessions/27820787/video/522042","isLocked":false,"duration":137000,"title":"Observability tools in the GDC SOC: Prometheus","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529194","prompt":null,"isOptional":true,"activities":[{"id":"522043","href":"/paths/1547/course_sessions/27820787/video/522043","isLocked":false,"duration":131000,"title":"Observability tools in the GDC SOC: Cortex","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529195","prompt":null,"isOptional":true,"activities":[{"id":"522044","href":"/paths/1547/course_sessions/27820787/video/522044","isLocked":false,"duration":92000,"title":"Observability tools in the GDC SOC: Fluent Bit","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529196","prompt":null,"isOptional":true,"activities":[{"id":"522045","href":"/paths/1547/course_sessions/27820787/video/522045","isLocked":false,"duration":119000,"title":"Observability tools in the GDC SOC: Loki","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529197","prompt":null,"isOptional":true,"activities":[{"id":"522046","href":"/paths/1547/course_sessions/27820787/video/522046","isLocked":false,"duration":288000,"title":"Management tools in the GDC SOC: ServiceNow","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529198","prompt":null,"isOptional":true,"activities":[{"id":"522047","href":"/paths/1547/course_sessions/27820787/video/522047","isLocked":false,"duration":100000,"title":"ServiceNow at Cymbal Federal","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529199","prompt":null,"isOptional":true,"activities":[{"id":"522048","href":"/paths/1547/course_sessions/27820787/video/522048","isLocked":false,"duration":110000,"title":"Management tools in the GDC SOC: GitLab","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529200","prompt":null,"isOptional":true,"activities":[{"id":"522049","href":"/paths/1547/course_sessions/27820787/video/522049","isLocked":false,"duration":119000,"title":"Management tools in the GDC SOC: Anthos Config Management (ACM)","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529201","prompt":null,"isOptional":true,"activities":[{"id":"522050","href":"/paths/1547/course_sessions/27820787/video/522050","isLocked":false,"duration":70000,"title":"Management tools in the GDC SOC: Fleet","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529202","prompt":null,"isOptional":true,"activities":[{"id":"522051","href":"/paths/1547/course_sessions/27820787/video/522051","isLocked":false,"duration":95000,"title":"Management tools in the GDC SOC: Harbor","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529203","prompt":null,"isOptional":true,"activities":[{"id":"522052","href":"/paths/1547/course_sessions/27820787/video/522052","isLocked":false,"duration":68000,"title":"Management tools in the GDC SOC: Red Hat Enterprise Linux (RHEL)","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529204","prompt":null,"isOptional":true,"activities":[{"id":"522053","href":"/paths/1547/course_sessions/27820787/video/522053","isLocked":false,"duration":84000,"title":"Management tools in the GDC SOC: MariaDB","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529205","prompt":null,"isOptional":true,"activities":[{"id":"522054","href":"/paths/1547/course_sessions/27820787/video/522054","isLocked":false,"duration":81000,"title":"Module summary","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529206","prompt":null,"isOptional":false,"activities":[{"id":"522055","href":"/paths/1547/course_sessions/27820787/quizzes/522055","isLocked":false,"duration":1680000,"title":"Knowledge check","description":null,"type":"quiz","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false}],"expanded":false},{"id":"76659","title":"Default logs, metrics, dashboards, and alerts in Splunk SIEM","description":"

This module introduces the Splunk security information and event management (SIEM) setup for GDC. You'll learn the basics of log collection, the types of information in GDC logs, and how to access them in Splunk. You'll explore metrics monitoring in Splunk, including accessing metrics through the Splunk UI. You'll learn to navigate Splunk dashboards, understand common chart types, and explore runbook and service dashboards. Using the Cymbal Federal use case, you'll learn how to navigate a runbook dashboard for incident response. Finally, you'll become familiar with the format of alerts and the alert inventory for the GDC Security Operations Center (SOC).

","steps":[{"id":"529207","prompt":null,"isOptional":true,"activities":[{"id":"522056","href":"/paths/1547/course_sessions/27820787/video/522056","isLocked":false,"duration":75000,"title":"Module overview","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529208","prompt":null,"isOptional":true,"activities":[{"id":"522057","href":"/paths/1547/course_sessions/27820787/video/522057","isLocked":false,"duration":145000,"title":"Log types in the GDC SOC","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529209","prompt":null,"isOptional":true,"activities":[{"id":"522058","href":"/paths/1547/course_sessions/27820787/video/522058","isLocked":false,"duration":352000,"title":"Audit logs","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529210","prompt":null,"isOptional":true,"activities":[{"id":"522059","href":"/paths/1547/course_sessions/27820787/video/522059","isLocked":false,"duration":97000,"title":"Audit logs at Cymbal Federal","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529211","prompt":null,"isOptional":true,"activities":[{"id":"522060","href":"/paths/1547/course_sessions/27820787/video/522060","isLocked":false,"duration":52000,"title":"Security logs","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529212","prompt":null,"isOptional":true,"activities":[{"id":"522061","href":"/paths/1547/course_sessions/27820787/video/522061","isLocked":false,"duration":97000,"title":"Operational logs","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529213","prompt":null,"isOptional":true,"activities":[{"id":"522062","href":"/paths/1547/course_sessions/27820787/video/522062","isLocked":false,"duration":47000,"title":"Operational logs at Cymbal Federal","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529214","prompt":null,"isOptional":true,"activities":[{"id":"522063","href":"/paths/1547/course_sessions/27820787/video/522063","isLocked":false,"duration":80000,"title":"Review: Logs in Splunk","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529215","prompt":null,"isOptional":true,"activities":[{"id":"522064","href":"/paths/1547/course_sessions/27820787/video/522064","isLocked":false,"duration":88000,"title":"Metrics in Splunk","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529216","prompt":null,"isOptional":true,"activities":[{"id":"522065","href":"/paths/1547/course_sessions/27820787/video/522065","isLocked":false,"duration":274000,"title":"Baseline metrics","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529217","prompt":null,"isOptional":true,"activities":[{"id":"522066","href":"/paths/1547/course_sessions/27820787/video/522066","isLocked":false,"duration":108000,"title":"Security-specific metrics in Splunk","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529218","prompt":null,"isOptional":true,"activities":[{"id":"522067","href":"/paths/1547/course_sessions/27820787/video/522067","isLocked":false,"duration":118000,"title":"Using Splunk metrics","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529219","prompt":null,"isOptional":true,"activities":[{"id":"522068","href":"/paths/1547/course_sessions/27820787/video/522068","isLocked":false,"duration":91000,"title":"Splunk metrics at Cymbal Federal","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529220","prompt":null,"isOptional":true,"activities":[{"id":"522069","href":"/paths/1547/course_sessions/27820787/video/522069","isLocked":false,"duration":333000,"title":"Splunk dashboards","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529221","prompt":null,"isOptional":true,"activities":[{"id":"522070","href":"/paths/1547/course_sessions/27820787/video/522070","isLocked":false,"duration":79000,"title":"Alerts in Splunk","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529222","prompt":null,"isOptional":true,"activities":[{"id":"522071","href":"/paths/1547/course_sessions/27820787/video/522071","isLocked":false,"duration":61000,"title":"Alerts at Cymbal Federal","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529223","prompt":null,"isOptional":true,"activities":[{"id":"522072","href":"/paths/1547/course_sessions/27820787/video/522072","isLocked":false,"duration":116000,"title":"Alert rules","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529224","prompt":null,"isOptional":true,"activities":[{"id":"522073","href":"/paths/1547/course_sessions/27820787/video/522073","isLocked":false,"duration":125000,"title":"The alert inventory","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529225","prompt":null,"isOptional":true,"activities":[{"id":"522074","href":"/paths/1547/course_sessions/27820787/video/522074","isLocked":false,"duration":60000,"title":"Module review","description":null,"type":"video","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529226","prompt":null,"isOptional":false,"activities":[{"id":"522075","href":"/paths/1547/course_sessions/27820787/quizzes/522075","isLocked":false,"duration":600000,"title":"Knowledge check","description":null,"type":"quiz","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false}],"expanded":false},{"id":"76660","title":"Resources","description":"

Review course content

","steps":[{"id":"529227","prompt":null,"isOptional":true,"activities":[{"id":"522076","href":"/paths/1547/course_sessions/27820787/documents/522076","isLocked":false,"duration":1800000,"title":"Course Slides","description":null,"type":"document","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false},{"id":"529228","prompt":null,"isOptional":true,"activities":[{"id":"522077","href":"/paths/1547/course_sessions/27820787/documents/522077","isLocked":false,"duration":1800000,"title":"Additional Resources","description":null,"type":"document","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false}],"expanded":false},{"id":"next-steps","title":"Your Next Steps","description":null,"steps":[{"id":"badge-step","prompt":null,"isOptional":true,"activities":[{"id":"badge","href":null,"isLocked":true,"duration":null,"title":"Course Badge","description":null,"type":"badge","isComplete":false,"inProgress":false,"score":null,"disabled":false}],"isComplete":false,"isTestedOut":false,"allActivitiesRequired":false}],"expanded":true}]

01

Introduction to SecOps on GDC