SOC Analyst

Event Analysis
This module establishes foundational skills in monitoring and analyzing security events across enterprise environments. Students learn to identify meaningful patterns in system and network activity, distinguish normal behavior from anomalous events, and prioritize alerts for investigation. The module covers event correlation techniques and introduces the core concepts that underpin effective SOC operations.
 

Firewalls
Students install and configure pfSense firewall systems, learning to create and manage firewall rules that balance security requirements with business needs. The module covers NAT implementation, packet filtering, and advanced features like package management for enhanced security control. Practical exercises focus on designing rule sets that protect network perimeters while enabling legitimate traffic flow.
 

IDS/IPS
This module covers the deployment and configuration of Snort-based intrusion detection and prevention systems. Students learn to write and tune detection rules, configure inline blocking capabilities, and integrate IDS/IPS with broader security infrastructure. The training emphasizes real-time monitoring, signature-based and anomaly-based detection methods, and reducing false positives while maintaining high detection rates.
 

Domain Events
Students work with Windows Server environments, Active Directory Domain Services, and domain protocols to understand enterprise authentication and authorization mechanisms. The module covers Group Policy management, domain controller operations, and Windows event logging. Students learn to use tools like Wireshark for protocol analysis and gain visibility into domain-level security events that are critical for detecting lateral movement and privilege escalation.
 

SIEM
This module introduces Security Information and Event Management platforms with a focus on the ELK Stack (Elasticsearch, Logstash, Kibana). Students learn to aggregate logs from multiple sources, normalize data for analysis, and build visualizations for security monitoring. The training covers index management, data parsing with Logstash, and creating Kibana dashboards that provide real-time visibility into security posture.
 

MITRE ATT&CK
Students learn to leverage the MITRE ATT&CK framework as a structured knowledge base of adversary tactics, techniques, and procedures. The module covers mapping observed behaviors to ATT&CK techniques, using the framework to guide threat hunting activities, and developing detection strategies aligned with common attack patterns. This knowledge enables analysts to think like adversaries and anticipate attack progression.
 

Log Analysis
This module develops advanced log analysis skills for identifying security threats across diverse data sources including network devices, servers, and security appliances. Students learn filtering techniques to efficiently process large volumes of log data, extract relevant indicators, and correlate events across multiple systems. The training emphasizes practical application of log analysis in real-world threat detection scenarios.
 

Splunk
Students master Splunk's Search Processing Language (SPL) to create complex queries for security event analysis. The module covers Splunk's interface, dashboard creation, alert configuration, and integration with security workflows. Students learn to extract meaningful insights from diverse data sources, build saved searches for recurring investigations, and configure alerts that enable proactive threat detection and rapid incident response.
 

Threat Hunting
This module covers proactive threat hunting methodologies including hypothesis-driven investigations and indicator-based searches. Students configure Sysmon XML settings to capture relevant system events, analyze process creation chains and network connections, and develop YARA rules for malware identification. The training emphasizes hunting for sophisticated threats that evade traditional detection methods, using tools and techniques that complement automated security controls.
 

Incident Response
Students learn the complete incident response lifecycle: preparation, identification, containment, eradication, recovery, and lessons learned. The module focuses on developing clear, actionable IR playbooks for common incident types including malware infections, data breaches, and insider threats. Students practice coordinating response activities, documenting incidents, and conducting post-incident analysis to improve future response capabilities and organizational resilience.