Sold by: SANS Institute
Deployed on AWS
Master network monitoring and threat detection at the packet level. Learn TCP/IP protocol analysis, zero-day threat detection, and network forensics using tcpdump, Wireshark, Snort, Suricata, and Zeek. Find malicious activity that automated tools miss.
Overview
Master network monitoring and threat detection at a depth unmatched in the industry. Find zero-day activity that tools miss through deep protocol understanding.
SEC503 takes a bottom-up approach that teaches you to understand what is happening on your network - not just interpret tool alerts.
Develop packet-level expertise:
Protocol Mastery
- Understand TCP/IP at the packet level
- Analyze application protocols deeply
- Research and understand new protocols
- Identify anomalies in network traffic
Threat Detection
- Find zero-day threats before disclosure
- Build effective detection rules
- Configure and tune detection tools
- Hunt for threats in network data
Tools and Techniques
- Master tcpdump, Wireshark, and tshark
- Configure Snort and Suricata
- Analyze traffic with Zeek
- Perform flow analysis with SiLK
37 hands-on labs with exercises for all experience levels. Red team members report this course also ups their game.
Earn GIAC GCIA certification (exam sold separately). 46 CPE credits across 6 intensive days.
Highlights
- Develop packet-level expertise: Analyze TCP/IP and application protocols deeply, detect zero-day threats before disclosure, identify anomalies in network traffic, and perform network forensics to reconstruct events.
- 37 hands-on labs: Wireshark and BPF filters, Snort and Suricata configuration, Zeek traffic analysis, Scapy packet crafting, evasion technique analysis, and a real-world bootcamp scenario.
- Prepares for GIAC GCIA certification. Built for SOC analysts, incident responders, and security engineers defending enterprise networks. 6 days, 46 CPEs.
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
SEC503 - Single User | Single user license for Defense - SEC503: Network Monitoring & Threat Detection In-Depth | $8,780.00 |
Dimensions summary
This listing offers one pricing option: a single-user license for the SEC503 Network Monitoring and Threat Detection In-Depth course. You buy access per person, billed as a contract. Pricing scales by the number of user licenses you purchase, so adding another learner means buying another single-user unit. There are no tiers or add-ons to choose between. The unit of measurement is one user, making it straightforward to match your purchase quantity to your team size.
Top-of-mind questions for buyers
One license covers a single named learner. It grants access to the SEC503 Network Monitoring and Threat Detection In-Depth course. This includes hands-on labs and course materials. The license is tied to one person and cannot be shared across multiple learners.
Buy one single-user unit for each additional learner. There is no combined team dimension, so cost scales directly with the number of licenses you purchase. Match your quantity to your team size, since each unit covers exactly one person.
The pricing table lists only the single-user course license. It does not state that a certification exam is included. The course maps to the GIAC Certified Intrusion Analyst credential, but for exam bundling details, contact the vendor.
www.sans.org+1
Helpful?
Vendor refund policy
Refunds available within 30 days if course not accessed.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Protect your dynamic cloud environments with consistent security, superior visibility, and advanced threat defense such as application visibility and control, deep packet inspection, IPS, malware defense, and URL filtering - powered by Cisco Talos® Threat Intelligence. Achieve deeper visibility into QUIC and TLS 1.3 traffic without breaking Layer 7 policies.
Protect your dynamic cloud environments with consistent security, superior visibility, and advanced threat defense such as application visibility and control, deep packet inspection, IPS, malware defense, and URL filtering - powered by Cisco Talos® Threat Intelligence. Achieve deeper visibility into QUIC and TLS 1.3 traffic without breaking Layer 7 policies.
F5 Distributed Cloud Bot Defense stops bots using signals and AI to achieve unparalleled long-term efficacy with near zero false positives.
Infoblox Threat Defense delivers preemptive DNS security to stop malware, ransomware, command-and-control (C2) communications, and DNS-based data exfiltration before they impact users or cloud workloads. It enriches SIEM, SOAR, and SOC operations with threat intelligence and automation.
Cloud Defense offers a revolutionary solution to discovering and protecting sensitive data in public cloud from modern ransomware and exfiltration attacks.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.