A SOC handles far more alerts than people can review by hand, so the way the team is organised and how much of the routine work is automated decide whether it keeps up. This final module looks at how a security operations centre actually runs, and how automation takes repetitive tasks off analysts so they can focus on real threats.
You'll start with what a SOC is and how its teams are set up. Then you'll learn what SOAR platforms do to connect tools and automate responses, see how to build automated workflows with the open-source Shuffle platform, and finish with a look at the day-to-day work of a Tier 1 analyst, which is where most people begin their SOC career.
Once you've finished the modules, move on to the Projects page to put the skills from this course into practice.
How a SOC monitors and detects threats around the clock, the teams that make it up, and the role it plays in a business's security.
How Security Orchestration, Automation, and Response platforms connect security tools, automate routine tasks and playbooks, and help a SOC respond to threats faster.
An introduction to Shuffle, an open-source SOAR platform for automating security work, alongside a free host intrusion detection system and SIEM.
The everyday work of an entry-level analyst, including alert monitoring, investigation, escalation, the common tools, and the skills the role asks for.