u/TruReyito

So was looking at my next class after GMLE (latter half of the MSISE program) and the "new" SEC598 (and associated cert) seems to perfectly line up with both where my org is heading, as well as even the tooling (Won't mention the tool, but at least one of the platforms that is extensive through the labs is on our Q2/Q3 onboarding process right now.

Tried to get them to allow me to take it as an elective, but that got shot down pretty quickly.

My next step is either pay out of pocket, or try to justify costs to my org and get them to foot the bill. Outside of a student, looking like an 8500 cost... anyone have any experience or info at all at swinging/dangling discounts? Are there workarounds for current students taking electives not in degree plan/etc? Avenue other than Academic Advisor to contact about possibly changing a class/etc?

Just took and passed the GMLE as part of the GIAC MSISE program. Got an 85.

Summary: I ❤️'d this class. I do NOT recommend this class to just anyone however. Explanation below:

As always start with my background.

Roughly 8-10 Years Experience, primarily in SOC roles, with some Engineering (SIEM setup, AWS Cloud/Guard Duty integrations, etc) and Detection Engineering (Alert writing) throw in.

Current Lead Threat Detection Analyst for large financial company.

Bachelors Degree (Cyber Security) from a brick and mortar, that had a strong focus on Programming (More on this later)
CISSP.
Handful of GIAC certs (see flair) as I complete the MSISE program.

Materials used: SANS On-Demand course. I took nothing to the test except my books. No other index other than that provided in the books. And 2 handwritten notes on how to do a Numpy Standard Deviation and the most complicated SQL query I could find that had all of the syntax's buried into the actual request. (NOTE TO SANS/GIAC INVESTIGATORS: I DID NOT SAY I USED THEM< JUST THAT I TOOK THEM. LOOK SOMEWHERE ELSE FOR YOUR END OF YEAR TEST COMPROMISE BULLET)

---------------------------------

I want to say, I wanted to take this class for a very long time. Especially after the last 3-4 SANS classes have been incredibly dry and admin like, this was nothing but HANDS ON TECHNICAL.

First, the course itself. The instructor (online) was fantastic. He had (at least for me) a very easy way of making some really hard concepts seem trivialy easy. In fact, he had an explanation for the Fourier Transformation that finally clicked in a way that never actually stuck across MULTIPLE professors/teachers across several schools/math courses.

And that gets down to the crux of this class: This is just about the first SANS class I felt was worthy of the name/educational status of a masters course. Even though its NOT a programming class. Even though its NOT a math class... it takes the time to actually explain the underlying mechanisms (without the rigourous proof of actual math) instead of just teaching you "Do this input, get X output"). You don't HAVE to understand the math to pass the course. No one is going to make you figure out a standard deviation by hand. Or apply a derivative to function. Nor do you HAVE to have all of numpy memorized, or understand sorting functions in python. However, you do have to work with all of that, so you can't be SCARED of them either.

Understanding the math both behind statistical analysis, as well as how that builds into actual machine learning and then utilizing it against actual data made me both enjoy the class, and actually WANT to spend more time studying just to... learn the concepts.

The course itself is spread across 6 of the thinnest books you've ever seen. They contain all the "theory" of what you are learning. However, the 2 WORKBOOKS are bigger than all the other books put together. And boy do you need to do the labs. There is no Intuitive way of understanding Python Libraries. Even if you SQL itself is easy, understanding how to wrap that same SQL into a python script requires actual hands on practice.

I ❤️ the fact that all of the lab material is actually a Kubernetes. With easy explanations on how set it up (went without a hitch, and I had never dealt with containers before). Frankly, every course so far that had labs could have benefitted from that.

The test itself was a good mix of "find this in the book" and "Heres code, do you understand what the output will be" understanding that you just wouldn't have unless you did the labs and experienced how it ran. For better or worse, I was exhausted at the end, and after I had answered enough Cyberlive Questions to know I had passed, I just skipped the last 3 or so.

-------------------

But, I do not recommend this course to just anyone. Mainly because: What would you do with it? So you learn regressions, and anomaly analysis... if you are not an active threat hunter or engineer... how will this help you? If you aren't directly involved with actual engineering operations, theres just nothing you can walk away from and apply. I am part of a large enterprise, and we have Splunks Machine Learning toolkit as part of our environment, and Have already started playing in there looking for ways to contribute, but if you don't have access to that (or, in a smaller shop, the freedom to setup your own Python environments and capture/analyze bulk amounts of log traffic) then frankly, its a waste of your time.

Great class. Great Subject matter. And Kudos to the course writer for making it actually a challenging learning density. Not for everyone though.

-----------

PS. As always, I did not make an index. However, unlike every other course I've taken so far... each and every volume of this course had its own mini-index in the back of the book. (well, not the lab books). And that helped immensely. Easily the most useful indices i've dealt with so far. There was still large gaps in the index, but at less than 100 pages for each book, searchign through them was not tough, especially if you are passably familiar with the books. I read each one cover to cover. Again, good course.

Took the course. Left all of the Quizzes until this monday just to refresh the information/navigation of the books. Took the two practice tests provided in the course on Wednesday/Thursday to get a good feel for what the indexes were lacking, and what labs I needed to bone back up on. Passed with what WOULD have been flying colors, but was exhausted. Very low "required" passing score (with a 65) and I feel like it was weighted very heavily towards the CyberLive questions.

That being said however... YOU CAN DO IT.gif

EDIT: Adding this because it has to do with ProctorU and not SANS/GIAC specifically...

They changed their requirements and it really messed with my mojo, workflow. I traditionally have taken the test with my camera on top of my monitor, leaned back in my office chair, keyboard on lap, mouse on my extra wide armrest. Watching the test on my giant monitor.

They changed all of that for this round. I HAD to set up the camera on the right side of my body, so they could see both me and my screen. And I couldn't keep my keyboard on my lap but on top of the table/desk.... which means I was ridiculously close to my monitor.... sitting awkwardly for 3 hours taking this test that my whole setup is just not.... designed for. Next time, I'll just pull out a laptop and do it at the kitchen table or something. if you haven't taken a test with them since Feb (that's when my last one was) be prepared for some changes).