Advanced Campaign tracking Mastery
RCCE students will learn threat actor campaign tracking including activity clustering, attribution analysis, infrastructure tracking, and campaign timeline reconstruction. RCCE students will learn to identify and track related threat activity across incidents, cluster threat actor campaigns using technical indicators, behavioral patterns, and targeting profiles, maintain campaign timelines and infrastructure databases, perform attribution analysis using diamond model and other analytic frameworks, produce campaign intelligence reports that inform defensive priorities, share campaign intelligence with trusted partners and ISACs, and update detections based on evolving campaign TTPs. This advanced mastery course challenges experienced practitioners with complex scenarios, expert-level techniques, and nuanced decision-making. At an expert level, RCCE students will learn to handle the most demanding situations in this domain, developing the expertise expected of senior security professionals. Students tackle multi-layered problems that require synthesizing knowledge across multiple disciplines.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Advanced Campaign tracking Mastery
- Execute hands-on tasks for advanced campaign tracking mastery
- Execute hands-on tasks for field guide
- Explain Course Overview fundamentals
- Execute hands-on tasks for what you will master — covering Track threat actor campaigns end-to-end, Cluster related activity across incidents.
- Execute hands-on tasks for prerequisites & audience — covering Senior SOC analysts & threat intel leads, Experience with MITRE ATT&CK framework.
- Execute hands-on tasks for senior soc analysts & threat intel leads — covering Experience with MITRE ATT&CK framework.
- Execute hands-on tasks for campaign tracking lifecycle
- Execute hands-on tasks for collection → clustering → correlation → attribution → reporting →
- Execute hands-on tasks for collection phase
- Execute hands-on tasks for analysis phase
- Execute hands-on tasks for output phase — covering Ingest alerts, IOCs, OSINT feeds, Cluster related indicators, Attribution assessments.
- Execute hands-on tasks for why it matters — covering Linking incidents reveals true scope, Campaign view drives proactive defense.
| Module 01 | Advanced Campaign Tracking Mastery |
| Module 02 | Field Guide |
| Module 03 | Course Overview |
| Module 04 | What You Will Master |
| Module 05 | Prerequisites & Audience |
| Module 06 | Senior SOC analysts & threat intel leads |
| Module 07 | Campaign Tracking Lifecycle |
| Module 08 | Collection → Clustering → Correlation → Attribution → Reporting → |
| Module 09 | Collection Phase |
| Module 10 | Analysis Phase |
| Module 11 | Output Phase |
| Module 12 | Why It Matters |
| Module 13 | Activity Clustering Foundations |
| Module 14 | What Is Activity Clustering? |
All hands-on labs run on Rocheston Rose X OS. Students practice advanced campaign tracking mastery by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for advanced campaign tracking mastery
- Lab 2: Execute hands-on tasks for field guide
- Lab 3: Explain Course Overview fundamentals
- Lab 4: Execute hands-on tasks for what you will master
- Lab 5: Execute hands-on tasks for prerequisites & audience
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Advanced Campaign tracking Mastery, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI