| Skill | What You Learn | Tools |
|---|
| Log Analysis | Find attacks hidden in access logs, syslog, Windows Event logs | grep, awk, Splunk, ELK |
| Incident Response | 6-step IR process — contain, eradicate, recover | Forensic tools, memory dumps |
| SIEM | Write detection queries for common attacks | Splunk SPL, Elastic KQL |
| Firewall Rules | Block attack traffic with proper rules | iptables, pfSense, AWS SG |
| IDS/IPS Signatures | Write Snort/Suricata rules to detect attacks | Snort, Suricata |
| Threat Hunting | Proactively search for attackers in your environment | osquery, Velociraptor |