Threat Intelligence Analyst
Follow this curated learning path to sharpen your ability to identify and contextualize emerging threats as a Threat Intelligence Analyst.
These four courses guide you through investigating threats, enriching log data, and translating findings into custom detection logic and reporting. Engage in hands-on practice within live demo environments to gain experience analyzing real-time data using a free Datadog trial account.
This path is designed specifically for Threat Intelligence Analysts and other roles responsible for researching, contextualizing, and reporting on emerging threats.
You’ll learn how to do the following:
Detect and Investigate Threats with Cloud SIEM
Secure your cloud environments with Datadog Cloud SIEM and cloud provider Content Packs. Explore out-of-the-box threat detection rules. Investigate incoming threats using Security Signals, Signals Explorer, and Cloud SIEM Investigator.
Enhance Log Querying and Analytics with Reference Tables, Subqueries, and Calculated Fields
Combine metadata with your logs using Reference Tables. Filter one set of logs against another set of logs using Subqueries. Create new fields using existing tags and attributes at query time using Calculated Fields.
Write Custom Cloud SIEM Detection Rules
Create custom detection rules for Datadog Cloud SIEM. Write detection rule queries using key log attributes and create notification rules to automatically alert stakeholders. Write suppression queries and manage detection rules as code.
Log Analytics with Notebooks
Learn how to use reference tables, transformation cells, and SQL queries in Datadog Notebooks to investigate log data. Join data from multiple sources to analyze suspicious IP activity and calculate the business impact of failed transactions.
