Intrusion Detection and Response

Course Description

Intrusion Detection and Response develops the technical competencies required to prevent, identify, assess, and respond to cybersecurity threats and incidents. It is explicitly a Security Operations Center (SOC) analyst preparation course: students learn to work with the detection technologies a SOC runs on, to triage and investigate alerts, and to execute the incident response process from detection through containment, eradication, recovery, and lessons learned.

Within the SCNS taxonomy, CNT is the Computer Networking prefix. This course sits late in an A.S. in cybersecurity, after both networking and security fundamentals — Daytona State requires CET1600 and CIS2350 — and it is typically the most operationally realistic course in the program. It appears at approximately four Florida institutions. The C suffix in the statewide inventory denotes an integrated lecture-and-laboratory course.

The distinguishing feature is that it is about practice under uncertainty rather than about tools. Real detection work is mostly ambiguity: an alert fires, and the analyst must decide within minutes whether it is a misconfiguration, a user doing something unusual but legitimate, or the first visible step of an intrusion — with incomplete information and more alerts arriving.

⚠ Title drift and suffix variation

Florida course inventories carry this number as CNT2404C "Intrusion Detection and Auditing." Daytona State publishes CNT2404 "Intrusion Detection and Response" — no suffix, and a meaningfully different emphasis. Auditing suggests compliance review and log examination after the fact; response is live incident handling. The DSC description is unambiguous about which it is: SOC analyst preparation, incident response, in-demand security operations skills.

SCNS equivalency does not cross numbers, and the suffix is part of the number. Read the catalog description rather than the inventory title, and note that the suffixed and unsuffixed forms carry different contact hours.

Learning Outcomes

Required Outcomes

• Describe the function and organization of a Security Operations Center and the tiered analyst roles within it.
• Explain the difference between intrusion detection and intrusion prevention, and between network-based and host-based deployment.
• Configure and tune detection rules, and explain the tradeoff between false positives and missed detections.
• Collect, normalize, and correlate log data from network devices, endpoints, servers, and applications.
• Use a SIEM platform to search, correlate, and build alerts and dashboards.
• Analyze network traffic and packet captures to identify anomalous or malicious activity.
• Triage an alert: establish what happened, what is affected, and whether escalation is warranted.
• Apply an adversary behavior framework such as MITRE ATT&CK to classify observed activity.
• Execute the incident response lifecycle: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.
• Distinguish a security event from a security incident and apply the organization's classification and escalation criteria.
• Preserve evidence appropriately, maintaining integrity and chain of custody.
• Apply threat intelligence and indicators of compromise to detection and hunting.
• Perform basic threat hunting: form a hypothesis, query for evidence, and document the result.
• Write a clear, accurate incident report and communicate status to technical and non-technical audiences.
• Describe the legal and regulatory obligations triggered by a security incident, including breach notification.

Optional Outcomes

• Perform basic malware triage and dynamic analysis in an isolated environment.
• Perform introductory digital forensics: disk, memory, and artifact analysis.
• Automate response actions through scripting or SOAR tooling.
• Detect threats in cloud and container environments.
• Participate in a tabletop exercise or purple-team activity.
• Prepare for an intermediate security operations certification examination.

Major Topics

Required Topics

• Security operations: SOC structure, roles, shifts, and workflow
• Intrusion detection and prevention systems; signature and anomaly detection
• Network security monitoring and sensor placement
• Logging, log sources, normalization, and retention
• SIEM operation: searching, correlation, alerting, and dashboards
• Endpoint detection and response
• Packet analysis and traffic inspection
• Alert triage, prioritization, and escalation
• MITRE ATT&CK and adversary tactics, techniques, and procedures
• The cyber kill chain and attack lifecycle models
• Incident response lifecycle and the incident response plan
• Containment, eradication, and recovery strategy
• Evidence handling, integrity, and chain of custody
• Threat intelligence and indicators of compromise
• Threat hunting fundamentals
• Incident documentation, reporting, and communication
• Post-incident review and detection improvement
• Legal and regulatory obligations, including breach notification

Optional Topics

• Malware analysis and triage
• Digital forensics: disk, memory, and network
• SOAR and response automation
• Cloud and container detection
• Deception technology and honeypots
• Tabletop exercises and purple teaming
• Insider threat detection

Resources & Tools

• Applied Incident Response (Steve Anson) or Incident Response & Computer Forensics (Luttgens, Pepe, Mandia) — the practitioner standards.
• The Practice of Network Security Monitoring (Richard Bejtlich) — the clearest articulation of the detection mindset this course teaches.
• NIST SP 800-61, Computer Security Incident Handling Guide — free, and the framework nearly every incident response plan is built on.
• MITRE ATT&CK (attack.mitre.org) — free and now the common language of detection engineering.
• CISA advisories and the Known Exploited Vulnerabilities catalog — free and operationally current.
• Open-source tooling for the laboratory: Security Onion (a full monitoring distribution), Suricata or Zeek, Wireshark, Elastic or Splunk Free, and Velociraptor.
• Public packet capture and log sample repositories — malware-traffic-analysis.net and similar — for realistic triage practice.
• CompTIA CySA+ and GIAC GCIH objectives for students continuing to certification; Blue Team Labs, LetsDefend, and TryHackMe for hands-on practice.

Career Pathways

• SOC analyst, Tier 1 — the direct destination and the most common genuine entry point into a security career.
• SOC analyst, Tier 2 / incident responder — deeper investigation and containment, typically after one to three years.
• Detection engineer — building and tuning the rules rather than working the queue; a well-paid and growing specialization.
• Threat hunter and threat intelligence analyst.
• Digital forensics examiner — corporate, consulting, or law enforcement, with additional training.
• Managed security service provider analyst — MSSPs hire in volume and are a realistic first employer.
• Security engineer — building the controls, a common move after operations experience.
• Florida employers: MacDill AFB (USSOCOM, CENTCOM) and its contractor base, the Space Coast defense corridor (L3Harris, Lockheed Martin, Northrop Grumman), financial services in Jacksonville, healthcare systems statewide, state agencies, cruise and hospitality companies, and a substantial MSSP sector. SOC codes 15-1212 Information Security Analysts and 15-1244 Network and Computer Systems Administrators.

Special Information

⚠ Florida gives you 30 days — breach notification is an operational constraint, not a legal footnote

This is the Florida-specific fact with the most direct effect on how incident response is actually run in this state. Section 501.171, Florida Statutes — the Florida Information Protection Act — requires notice to affected individuals within 30 days of determining that a breach of personal information occurred, and notice to the Department of Legal Affairs within 30 days where 500 or more Floridians are affected. Third-party agents must notify the covered entity within 10 days.

The practical consequence for an analyst: the investigation is on a clock, and the clock is short. Determining scope — which systems, which records, whose data — is the slow part of any real incident, and 30 days is not generous when logs are incomplete or retention was too short. This is the concrete reason logging and retention decisions made months earlier determine whether an organization can meet its legal obligation. Sector rules stack on top: HIPAA has its own timeline for Florida's very large healthcare sector, and defense contractors carry separate DFARS/CMMC reporting duties. These requirements are amended periodically — verify the current statute rather than relying on this guide.

⚠ The real job is alert fatigue, and it is why SOC analysts burn out

Students imagine security operations as investigation and discovery. The honest description is that a Tier 1 analyst works a queue, and the overwhelming majority of alerts are false positives or benign anomalies. Volume is high, most of it is noise, and the analyst must nonetheless treat each one seriously, because the cost of dismissing the wrong one is the incident.

This produces two well-documented failure modes worth naming before students meet them:

• Alert fatigue — the gradual, unconscious drift toward closing alerts quickly, which is precisely how real intrusions get closed as noise.
• Burnout and turnover — SOC work involves shift rotation including nights and weekends, sustained vigilance, and a metric structure that can reward speed over accuracy. Turnover in Tier 1 roles is high across the industry.

What actually helps, and what the course should teach: tuning is not cheating. A rule that produces a hundred false positives a day is a broken rule, and fixing it is analyst work of the highest value. Documenting why an alert was closed matters as much as closing it. And — the same lesson that recurs across this repository — a metric used to evaluate individuals stops measuring what it did: a SOC graded on alerts-closed-per-hour will close alerts quickly and investigate less. Use the metrics diagnostically.

⚠ Evidence handling: what you do in the first ten minutes determines whether the case survives

The instinct on discovering a compromised machine is to fix it — reboot it, run antivirus, wipe and reimage. Each of those destroys evidence, and volatile evidence in particular (running processes, network connections, memory-resident malware) is gone the moment the machine is powered off.

The professional sequence is isolate, preserve, then remediate: disconnect from the network without powering down, capture volatile data and then disk images, hash everything, and document who did what and when. Chain of custody is not only for cases headed to court — it is also what makes an insurance claim, a regulatory response, or an internal disciplinary action defensible. Where an incident may involve criminal activity or an insider, involve legal counsel and law enforcement early, and understand that an organization's own investigation can compromise a later prosecution.

One further caution students should hear: the containment decision is a business decision, not only a technical one. Pulling a production system offline has cost, and the analyst's job is to present the tradeoff clearly to the person authorized to make that call, not to make it unilaterally.

⚠ Authorization still governs everything — lab tools stay in the lab

The tooling in this course is powerful and dual-use. The same constraint from the prerequisite security course applies with more force here: under the Florida Computer Crimes Act, Chapter 815, F.S., unauthorized access to a computer or network is a criminal offense rising to felony levels, and the federal Computer Fraud and Abuse Act applies in parallel. Monitoring traffic is itself regulated — capturing network traffic containing others' communications implicates wiretap law, and Florida is a two-party consent state for communications interception under Chapter 934, F.S., which is stricter than federal law. Run captures only on lab networks or on networks you are explicitly authorized to monitor, and understand that an employer's authorization is scoped and documented, not general.

AI Integration

Security operations is among the fields most changed by machine learning and generative AI, and a current course should treat it substantively.

Where it helps. Alert enrichment and summarization, translating between query languages, explaining an unfamiliar binary's behavior or an obfuscated script, drafting detection rules, and producing the first version of an incident report. Machine learning already underlies user and entity behavior analytics and much modern endpoint detection — analysts increasingly need to understand roughly why a model scored something as anomalous, and to recognize that they often cannot.

Where it fails. Models hallucinate confidently — invented CVE identifiers, invented tool options, plausible-sounding but wrong log field semantics. In detection work an unverified answer can close a real incident as benign. And the data hazard is acute: logs, packet captures, and incident details are sensitive by definition, frequently containing personal information, and pasting them into a public AI service is a disclosure that may itself be reportable under § 501.171, F.S.

What has changed on the attacker side. AI has measurably improved phishing quality, removing the language errors students are traditionally taught to look for, and has made voice and video deepfakes practical for business email compromise and help-desk social engineering — including live impersonation of an executive on a video call. Detection guidance built on "look for bad grammar" is obsolete; out-of-band verification of the request is the control that still works. This area moves quickly; verify current guidance rather than relying on this guide.

Course format, credits, and contact hours

The 3 credits and 60 contact hours reported here reflect the C-suffixed integrated form in the statewide inventory, at the 20-hours-per-credit convention this repository's CET and CNT integrated courses use consistently. Daytona State's unsuffixed CNT2404 is 3 credits, offered in spring, with prerequisites CET1600 and CIS2350. Confirm on your institution's syllabus.

Expect heavily laboratory-weighted assessment: alert triage against real capture and log data, SIEM query construction, and written incident reports. The written report deserves more attention than students give it — in professional practice, an investigation that cannot be explained clearly to a manager, an auditor, or counsel has not been completed.

Transfer and articulation

How Florida course levels affect transfer: the first digit of an SCNS number denotes the year of offering, not transferability. 1000- and 2000-level courses transfer transparently between Florida public institutions; the boundary that matters is 2000 to 3000, where lower-division credit generally cannot satisfy an upper-division requirement. CNT2404C transfers as lower-division credit and will not substitute for an upper-division security or forensics course in a bachelor's program. Note also the suffix caution above.