...
Service lifecycle and secure practices during of each stage should be covered in-depth. These stages include requirement gathering, technology investigation, development, testing, deployment, production operation and retirement. It should also cover transitioning between stages.
...
Monitoring and logging
Monitoring and logging are the essential components which allow to track system events in their historical order. Without monitoring you are not able to be aware of any events going on in your system. Having found suspicious system behaviour must ultimately lead to further investigations, which normally are able only if extended logging has been done continuously.
The training will/should provide an overview about available monitoring and logging tools, central system logging and techniques used to analyse those combined loggings. Only centralized logging helps to combine system and network activities and get a comprehensive look on the overall attack.
Forensics
Incident response and analysis
...