Network Traffic Analysis

NOVEMBER 8–11, 2021 (APAC)

Sophisticated attackers frequently go undetected in a victim’s network for an extended period. Attackers can blend their traffic with legitimate traffic that only skilled network analysts know how to detect. This course shows learners how to identify malicious network activity.

If you have any additional questions, send us an email. Thank you.

mandiant academy


The course provides an overview of network protocols, network architecture, intrusion detection systems, network traffic capture and traffic analysis. Learners review the types of network monitoring and the tools commonly used to analyze captured network traffic. The course also explores the best techniques for investigating botnets and how to use honeypots in network monitoring.

The course includes lectures and hands-on lab sessions to reinforce technical concepts.



  • START DATE: November 8, 2021 
  • END DATE: November 11, 2021 
  • TIME: 8:00am–2:30pm Singapore Time, daily
    • 0:00–06:30 UTC
    • 11:00am–5:30pm AEDT
  • COST: US$4,000 or 4 EOD units
Expertise On Demand (EOD) units will be accepted


After completing this course, learners should be able to:

  • Understand the network monitoring and incident response processes, and why it’s critical in today’s network environments. Discuss the pros and cons of statistical, connection, full content and event monitoring and tools
  • Perform event-based monitoring using Snort
  • Minimize network traffic with the Snort rule structure and custom rule creation
  • Review Snort alerts using the Sguil front end


Day One
  • NTA In Incident Response
  • Networking Refresher & Linux Overview
Day Two
  • Network Packet Analysis
  • Network Sensor Deployment
Day Three
  • Netflow Analysis
  • Full Packet Capture
Day Four
  • Snort Alerts
  • Question & Answer Session


Information technology and security staff, corporate investigators and other staff members who need to understand networks, network traffic, network traffic analysis and network intrusion investigations. 


A basic understanding of TCP/IP and Windows and UNIX platforms. Familiarity with security terminology and a working knowledge of Wireshark is also recommended. 


Students will require a computer that meets the following minimum requirements:

  • Operating System: Windows 7 or newer
  • Processor: Core i5 or equivalent
  • RAM: At least 6GB, preferably 8GB
  • HDD: At least 25GB free space
  • Virtual machines are acceptable provided at least 4GB of RAM can be allocated. Students are responsible for providing their own copies of and licenses for Windows.


Students will receive a lab book and access to all required class materials and tools.

Additional Education Services

Mandiant offers numerous training services, including teacher-led and web-based training. The full catalog is available on the Mandiant Academy site.