About SOC Analyst
A Security Operations Center (SOC) analyst is the first line of defence for an
organisation: watching alerts, investigating suspicious activity, and responding
before an incident turns into a breach. This course follows the path most analysts
take, starting with Networking & Security Fundamentals (TCP/IP,
DNS, firewalls, and common protocols), then Operating Systems & Command
Line so you are comfortable on both Windows and Linux.
Next comes Threat Landscape & Attack Frameworks, covering
malware types, phishing, the Cyber Kill Chain, and MITRE ATT&CK. From there,
Log Analysis & SIEM teaches you to collect, search, and
correlate events in tools like Splunk, Elastic, and Microsoft Sentinel, while
Network Traffic Analysis covers packet captures with Wireshark and
detection with Zeek and Suricata.
Endpoint Detection & Response covers EDR tools, Sysmon, and
spotting malicious process behaviour, and Threat Intelligence &
Hunting covers indicators of compromise, intelligence feeds, and
proactively looking for threats that alerts missed.
Finally, Incident Response & Forensics covers the response
lifecycle, evidence handling, and disk and memory analysis,
Vulnerability Management covers scanning and prioritising
weaknesses, and Automation & SOC Operations covers SOAR,
scripting, playbooks, and reporting: the skills that turn a good analyst into one
who can keep up with the alert volume of a real SOC.
Content
10 modules
01
Networking & Security Fundamentals
The OSI and TCP/IP models, IP addressing, DNS, common protocols, and how firewalls, proxies, and VPNs shape network traffic.
TCP/IPDNSFirewalls
02
Operating Systems & Command Line
Working confidently in Windows and Linux: processes, services, file systems, permissions, the registry, and the shell commands analysts use daily.
LinuxWindowsPowerShell / Bash
03
Threat Landscape & Attack Frameworks
Malware families, phishing, ransomware, and how attackers move through an environment, mapped to the Cyber Kill Chain and MITRE ATT&CK.
MITRE ATT&CKKill ChainPhishing
04
Log Analysis & SIEM
Collecting and normalising logs, writing searches and detection rules, and triaging alerts in a SIEM such as Splunk, Elastic, or Microsoft Sentinel.
SplunkElasticDetection Rules
05
Network Traffic Analysis
Reading packet captures, spotting beaconing, scans, and data exfiltration, and using IDS/IPS tools to detect threats on the wire.
WiresharkZeekSuricata
06
Endpoint Detection & Response
Monitoring hosts with EDR and Sysmon, investigating suspicious processes and persistence, and isolating compromised machines.
EDRSysmonWindows Event Logs
07
Threat Intelligence & Hunting
Using indicators of compromise and intelligence feeds to enrich alerts, then hunting proactively for threats that detections missed.
IOCsVirusTotalThreat Hunting
08
Incident Response & Forensics
The incident response lifecycle, evidence handling and chain of custody, and the basics of disk, memory, and email forensics.
NIST IR LifecycleVolatilityEmail Analysis
09
Vulnerability Management
Scanning assets, reading CVEs and CVSS scores, prioritising what to patch first, and tracking remediation through to closure.
NessusCVE / CVSSPatch Management
10
Automation & SOC Operations
Automating repetitive triage with scripts and SOAR playbooks, and running a SOC day to day: tiers, shift handovers, metrics, and reporting.
SOARPythonPlaybooks
What You Can Do After This Course
By the end of the curriculum you'll have worked through 5 hands-on projects and
covered the core of what a Tier 1 to Tier 2 SOC analyst role expects. Concretely,
you'll be able to:
Understand the environment you defend: explain how networks, Windows, and Linux systems work and where attackers look for weaknesses.
Recognise attacker behaviour: map activity to MITRE ATT&CK and the Kill Chain, from phishing emails to lateral movement.
Triage alerts in a SIEM: search logs, write detection queries, and separate false positives from real incidents.
Investigate traffic and endpoints: analyse packet captures, Sysmon events, and EDR telemetry to confirm what actually happened.
Enrich and hunt: use threat intelligence to add context to alerts and hunt for activity your detections missed.
Respond to incidents: contain, investigate, and document an incident following a recognised response lifecycle.
Work efficiently in a SOC: prioritise vulnerabilities, automate repetitive tasks, and write clear reports and handovers.