SOC Analyst Practical Lab Program

OSI Model, TCP/IP Stack, IP Addressing and Subnetting, DNS Resolution Process, HTTP/HTTPS Protocol, Common Ports and Services, Packet Capture and Analysis (Wireshark)

Windows Security (Event Logs, Registry, Services, PowerShell Basics), Linux Security (File Permissions, Processes, Syslog, Auditd), User and Privilege Management, Basic PowerShell Scripting for Windows Forensics

Threat Actors and Motivations, Malware Types (Virus, Trojan, Ransomware, Spyware), Phishing and Social Engineering, Attack Vectors, MITRE ATT&CK Framework Overview

SIEM Architecture, Log Sources and Ingestion, Log Normalization and Parsing, Search Queries and Filters (Splunk SPL Basics, KQL for Microsoft Sentinel), Dashboard Creation, Use Case Development, Specific Tools (Splunk, Elastic, QRadar, Microsoft Sentinel)

Windows Event Logs (Security, System, Application), Linux Syslog and Journalctl, Web Server Logs (Apache/Nginx), Firewall Logs, Correlation Rules, Timeline Reconstruction, Intermediate Python/PowerShell Scripting for Log Parsing and Detection Automation

Cloud Log Sources (AWS CloudTrail, Azure Activity Logs, GCP Audit Logs), Multi-Cloud SIEM Ingestion and Use Cases, Cloud-Specific Alert Triage

Endpoint Telemetry, Process Creation and Behavior, File Modifications, Network Connections from Endpoints, Alert Triage, Basic Hunting Queries

Intrusion Detection Systems (IDS) Concepts, Signature-Based vs Anomaly Detection, Network Traffic Analysis, Protocol Analysis (HTTP, DNS, SMB), Zeek/Suricata Logs Basics

Hypothesis-Driven Hunting, Hunting Maturity Model, Data Sources for Hunting, Query Languages (Splunk SPL, KQL), Baseline Establishment, Anomaly Identification, Threat Intelligence Fundamentals, IOC Enrichment Workflows (Feeds, VirusTotal API Sim)

Azure AD/Entra ID Sign-In Logs and Attacks, Active Directory Security Events, Brute-Force/Pass-the-Hash/Golden Ticket Detection

Incident Response Lifecycle (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned), Incident Classification and Severity, Evidence Handling and Chain of Custody

Static Analysis (File Hashes, Strings, PE Headers), Dynamic Analysis (Sandbox Behavior), Indicators of Compromise (IOCs), YARA Rules Introduction

Vulnerability Scanning Concepts, Common Vulnerabilities (CVE), CVSS Scoring, Patch Management Process, False Positive Identification

SOAR Concepts, Playbook Development Basics, Automation Workflows, Integration with SIEM/EDR, Case Management

Behavioral Analytics and UEBA Concepts, Machine Learning-Driven Detection (Anomaly Detection, Baselines), AI-Powered Tools in SIEM (Splunk ML Toolkit, Elastic ML Jobs, Sentinel Fusion/UEBA), Interpreting AI-Generated Alerts, Hands-On Labs for Reviewing Behavioral Anomalies

Full Incident Simulation and Response (Including Cloud, Identity, AI/ML Alerts), Alert Triage and Investigation, Report Writing, SOC Metrics and KPIs, Resume Development, Interview Preparation (Common SOC Analyst Questions Including Cloud/AI Context), Certification Alignment (CompTIA Security+, CySA+, Splunk Certified User/Power User, SC-200 Microsoft Security Operations Analyst)