Any feedback on SEC599 (GDAT)?

As a pure DFIR, it was always intriguing to see how the otherside works. (I believe that's how the Red team feel about us too).

That been said, at this point I honestly don't want another course that goes all about just what an offense tool does and how to counter it or to go theoretical about how to break the kill chain ...etc.
What also worries me, is that both authors (while crazy enough for my taste

) are pure PT, so this course might be more aligned with a Red Team member than a Blue Team member.

Any thoughts in general or feedback from those who took the course?

Thanks in advance!

Course Link

Find more posts tagged with

Comments

johndoee

al88 wrote: »

As a pure DFIR, it was always intriguing to see how the otherside works. (I believe that's how the Red team feel about us too).

That been said, at this point I honestly don't want another course that goes all about just what an offense tool does and how to counter it or to go theoretical about how to break the kill chain ...etc.
What also worries me, is that both authors (while crazy enough for my taste ) are pure PT, so this course might be more aligned with a Red Team member than a Blue Team member.

Any thoughts in general or feedback from those who took the course?

Thanks in advance!

Course Link

I try to let other people answer before I jump in and give my thoughts. Welp, here I go:

In the past week, two courses that I applied for added the SEC599 training and certification attempt. I think they are just now adding the certification attempt to the training, within the past week or two. It was just training with no attempt. Some courses they add the exam so they don't. You never know.

It's currently 0 certified professionals last time I checked 2 seconds ago.

Considering they just added the certification attempt this month I am sure it's a little premature for certification attempts.

If someone had done the training, when the certification attempt was not offered I am quite sure they would not have done an index. An index is only mainly used for testing purposes. So, if someone did the training prior to the certification attempt, unless they are 2% er they more than likely would have to go through the material to create an index. 2% of the people that attend do the exam without an index...or at least that is what they say. I am not there watching them take the exam so you would hope they are telling the truth..

With that being said, I would assume it'll be a little bit before you start to see the first pass. They only have six live training events in the next 6 months and no OnDemand option. So, you can make your own judgment.

Considering it's a new course every 60-120 days it's impossible to have 10-20 courses at each training event. So, it's supply and demand. Although I did see

johndoee

To add to that, the six that are within the next 6 months are all overseas!

airzero

The course looks more like a more in depth 504 targeted towards defending against APTs. Seems to be meant for more of the government or fortune 100 type crowd, but could be useful information. Would love to hear thoughts from anyone that has taken it!

Sheiko37

There seems a lot of crossover between 530 and 599, and reading the syllabus of both they definitely don't appear more aligned for red team members, it's nearly entirely defense and system hardening.

bhuvanesh2016

I finished last week and am very pleased to report that I received an 88% on the (GDAT - SEC599) exam. Exam was moderately difficult and challenging. The course content is fantastic and aids in the development of a career in Purple Teaming as well as the proper implementation of the syllabus.