Security Operations Centre Analysis

Course content

1. 1What a security operations centre doesComing
2. 2Log sources and collectionComing
3. 3SIEM platformsComing
4. 4Writing detection rulesComing
5. 5Alert triageComing
6. 6Investigating endpoint activityComing
7. 7Investigating network activityComing
8. 8Email and phishing analysisComing
9. 9The MITRE ATT&CK framework for defendersComing
10. 10Reducing false positivesComing
11. 11Shift handover, metrics and reportingComing
12. 12Capstone: a shift in the SOCComing

Requirements

• CYB-101 Security Fundamentals
• NET-103 Linux Administration

Recommended background. You can start any course at any time.

Description

Working as a SOC analyst: collecting logs, using a SIEM, triaging alerts, investigating events and escalating real incidents.

Part of the Information Technology stream, typically taken in year 2.