•SIEM-Security Information and Event ManagementELK and Splunk Event Analysis, Advanced Search, Setup, Log Management, Dashboards, Anomaly Detection, Splunk SPL•Threat HuntingCyber-attack dealing, Detecting and isolating threats, Searching through networks, Analytics-Driven, Intelligence-Driven- Rapid7 solutions•Incident ResponseSix-step plan by SANS•Digital ForensicsAnalyzing attacks by tools included Volatility, Wireshark, Mandiant RedLine, Autopsy, Netwitness, WinPrefetchView, FTK Imager, fmem•Network traffic analysisCollecting a real-time record of what’s happening on network traffic, Detecting the use of vulnerable protocols and ciphers. Full packet capture(Arkime) and Netflow setup config and monitor•Intrusion Detection In-Depth & metadata-IDS solutionNIDS-HIDS srtup, config and monitor. Suricata, Zeek, Security Onion and snort•Linux systems config&tune services and components•Good knowledge with routing and switching