OT Monitoring & SOC

Course Description

OT Monitoring and SOC (OTSE-0203) builds on foundational OT and network architecture knowledge by providing best practices for deploying detection and monitoring sensors, extracting meaningful logs and security events from OT hardware and software, and aggregating this security context into an OT DMZ staging area. These logs, events and alerts can be forwarded to an IT, OT, or IT-OT SOC, either managed in-house or by a MSSP service provider. Key topics for this 1-day course include OT SIEM deployment, custom protocol signatures, IT/OT correlation, and SOC staffing models. Participants will also learn to utilize SOAR, threat feeds, and threat hunting to shift operations from a reactive to a proactive security posture.

Target Audience (Roles):

• OT/ICS SOC Analyst (Tier 1, 2, & 3)
• Security Analyst (expanding into OT)
• Threat Hunter
• Incident Response (IR) Handler
• MSSP Analyst / Engineer (working for managed service providers)
• SIEM Engineer / Administrator (Splunk, QRadar, Sentinel, etc.)
• OT Security Engineer
• Security Architect (focusing on Logging & Monitoring)
• Detection Engineer (writing custom signatures)
• Industrial Network Security Engineer
• SOC Manager / Director
• Manager of OT Security
• Director of Security Operations (SecOps)
• CISO (specifically those looking to integrate IT/OT monitoring)

Course Details

Faculty: Marc Visser and Vincent Seruch
Course Duration: 7HR+ with exam (split between morning and afternoon)
Bonus: Includes 6 month access to online course through CambiOS Academy
Certificate Included: Yes