SOC Analyst Level 1 — detection, analysis and incident response

• Understand how a security operations centre is organized and the analyst's role.
• Master the fundamentals: logging, telemetry, threat frameworks.
• Use an event collector: collection, normalization, correlation.
• Qualify an alert, rule out false positives and document an investigation.
• Analyse common incidents: compromised account, phishing, lateral movement.
• Apply a response plan and write an actionable incident report.

• Aspiring analysts and technicians moving into security.
• Systems and network administrators transitioning to cybersecurity.
• Support teams required to handle security alerts.

• Linux and Windows systems basics.
• Sound understanding of TCP/IP networking.

Day 1 — Foundations of defence

• Security operations centre organization, tiers and processes
• Threats, tradecraft and the attack chain
• Adversary technique framework and detection use cases

Day 2 — Logs and telemetry

• System, network and application log sources
• Event collection, normalization and enrichment
• Network detection and flow analysis

Day 3 — Working with the event collector

• Getting started with the platform and event searching
• Correlation rules, thresholds and noise reduction
• Dashboards and indicator tracking

Day 4 — Investigation

• Alert qualification methodology
• Analysing an account compromise and a phishing campaign
• Analysing a compromised host and hunting for lateral movement

Day 5 — Response and reporting

• Incident response plan and containment actions
• Threat intelligence and indicators of compromise
• Writing the incident report and closing exercise