CIS 296 - Incident Response and SIEM

5.0 Credits
Covers a methodical and forensically sound approach to dealing with security breaches (also known as incidents). Students will learn how to manage incidents so that damage is limited and recovery time is optimal. Real-time monitoring and correlation of events taking place within an information system will be covered as well as conducting a detailed analysis of log data from various systems. This course forms the nexus between the digital forensics and cyber security courses.
Prerequisite CIS 272 and CIS 274 with a minimum grade of 2.5or concurrent enrollment or instructor permission.
Course-level Learning Objectives (CLOs)
Upon successful completion of this course, students will be able to:

Implement a plan to mitigate the likelihood and impact of incidents.
Develop a comprehensive incident response plan.
Recover data in a forensically sound fashion from a variety ofcomputing devices.
Detect compromises using key Windows events.
Identify internal pivoting activity using log data.
Detect post exploitation using command line logging.
Configure Security Information Event Management (SIEM)tripwires.
Apply long tail analysis concepts to identify abnormal systemusage.
Implement phone home tracking methods.

Course Typically Offered
Fall, Winter