SOC Analyst: Beginner to Job Ready
Security Operations Center fundamentals, detection, alert triage and incident investigation
Course Overview & Target Audience
Grounded entirely in our official academic course specifications.
What You Will Learn
This course introduces learners to the daily work of a Security Operations Center (SOC). Learners build foundational knowledge of networks and operating systems, examine security telemetry, work with SIEM tools, triage alerts, investigate suspicious activity, and communicate findings. Guided exercises progress toward realistic investigation scenarios and a final capstone.
Summary: Build foundational SOC skills through network and endpoint log analysis, SIEM workflows, alert triage, threat hunting and incident investigation. Learners finish with an evidence-based investigation report and practical portfolio artifact.
Who Should Attend & Prerequisites
Undergraduate students, freshers, career switchers, IT professionals entering cybersecurity, and junior security analysts.
Basic computer literacy is sufficient. Introductory networking or operating-system knowledge is helpful but not required.
Documented Learning Outcomes
Verifiable capabilities developed through guided exercises, technical investigations, and structured reporting.
Each week is planned for approximately 8 guided hours, combining concept instruction, demonstration, guided practice, and review.
Week 1
Cybersecurity and SOC Fundamentals
- Cybersecurity goals, confidentiality, integrity and availability
- Threat actors, attack surfaces, common attack techniques and incident types
- SOC operating model: Tier 1, Tier 2, Tier 3 and supporting teams
- Alert lifecycle: detection, triage, investigation, escalation and closure
- Incident severity, business context, evidence quality and analyst documentation
- Introduction to MITRE ATT&CK and the incident response lifecycle
Week 2
Networking Fundamentals for SOC Analysts
- OSI and TCP/IP models, IP addressing, subnets and common ports
- DNS, DHCP, HTTP/S, SMTP, SSH, RDP and other commonly investigated protocols
- Firewalls, VPNs, proxies, NAT and basic network segmentation
- Connection metadata, IP reputation, domains and URL components
- Packet capture fundamentals and a first look at Wireshark
- Limits of network evidence, encrypted traffic and false assumptions
Week 3
Linux and Windows Fundamentals
- Files, processes, services, users, groups and permissions
- Windows Event Viewer, security events, PowerShell and Sysmon concepts
- Linux shell basics, authentication logs, system logs and SSH activity
- Process and service context; basic persistence concepts
- Time zones, timestamps, hostnames and user identity correlation
- How endpoint telemetry is generated and what may be missing
Week 4
SIEM Fundamentals and Wazuh
- What a SIEM does and where it fits in a SOC
- Wazuh architecture, agents, manager, indexing and dashboards at a conceptual level
- Log collection, parsing, rules, alerts and dashboards
- Agent onboarding and validation in a controlled lab
- Reading alerts and investigating related events
- Detection-rule logic, tuning and common data-quality issues
Week 5
Splunk and Security Log Analysis
- Splunk concepts: events, fields, indexes, sourcetypes and time ranges
- Introductory Search Processing Language (SPL) patterns
- Filtering, sorting, aggregation and grouping events
- Authentication and endpoint investigations using sample data
- Pivoting between related fields and validating search results
- Saved searches and introductory alert concepts
Week 6
Threat Detection and Alert Triage
- Triage workflow: validate, enrich, scope, prioritize and decide
- Severity versus confidence, asset criticality and business impact
- False positives, benign explanations and escalation criteria
- Basic IOC enrichment using reputable public sources and lab artifacts
- Mapping behaviour to MITRE ATT&CK without overclaiming attribution
- Writing concise, reproducible case notes
Week 7
Incident Response and Threat Hunting
- Incident response preparation, detection, analysis, containment, eradication and recovery
- Scoping the incident and determining affected identities, hosts and services
- Evidence preservation and coordination with IT, cloud and response teams
- Threat-hunting hypotheses and questions that can be tested with telemetry
- Correlating alerts, endpoint records, network evidence and identity activity
- Communication, escalation, lessons learned and detection improvement
Week 8
SOC Capstone and Career Preparation
- End-to-end SOC case management and evidence-based decision-making
- Correlation of alerts, endpoint events, identity events and network observations
- Incident timeline and ATT&CK mapping where evidence supports it
- Impact assessment, containment recommendations and residual uncertainty
- Technical report writing, executive summary and verbal handover
- Portfolio presentation and interview-style investigation discussion
Tools, Software & Lab Environments
Transparent breakdown of course tools, target scenarios, and environment boundaries.
Course Tools & Software
Documented software and utilities utilized across weekly exercises:
Target Environments
Wazuh SIEM cluster, prepared PCAP traffic captures, Windows Event Logs, Sysmon telemetry, and simulated SOC tier 1 triage incidents.
Environment Boundaries
The academy utilizes open-source and free community tools. We do not provide commercial software licenses (such as Burp Suite Professional) or live enterprise systems.
Cloud security exercises run in learner-provisioned subscriptions or prepared telemetry datasets.
Suggested Assessment Structure
Assessment components documented in the official course syllabus.
Part of the suggested assessment structure in the official syllabus.
Part of the suggested assessment structure in the official syllabus.
Part of the suggested assessment structure in the official syllabus.
Part of the suggested assessment structure in the official syllabus.
The course specifications suggest a 70% overall minimum score, including satisfactory completion and submission of the final capstone project. Note: This passing threshold is a proposal and requires final client confirmation before formal cohort enrolment begins.
Frequently Asked Questions
Grounded in documented course specifications and operational policies.
Do I need prior experience as a security analyst to enrol in this course?
What tools will I work with during the practical exercises?
Does the academy provide commercial Splunk licenses or proprietary threat intelligence feeds?
What is required to complete the course successfully?
Ready to Explore Further Pathways?
Compare our practice-led training courses across SOC Analysis, Ethical Hacking, Azure Cloud Security, and Digital Forensics, or review our hands-on laboratory environments.