SOC Analyst & Cybersecurity Defense

• 1.1. What is Cybersecurity? SOC Analyst career overview
• 1.2. Networking Fundamentals: TCP/IP, OSI Model layers
• 1.3. Ports, Protocols & Services (HTTP, DNS, DHCP, SSH, RDP)
• 1.4. IP Addressing, Subnetting & Routing basics
• 1.5. DNS, DHCP & how network services work
• 1.6. Wireshark: Packet capture, filters & traffic analysis
• 1.7. Network security devices: Firewalls, IDS/IPS, Proxy
• 1.8. Hands-on lab: Capture & analyze HTTP/DNS traffic

Understand TCP/IP, OSI model, ports, protocols, and analyze real network traffic with Wireshark — the foundation every SOC analyst needs.

Every security alert involves network traffic. Understanding how packets flow, what normal looks like, and how to filter captures is the first skill interviewers test.

• 2.1. CIA Triad: Confidentiality, Integrity, Availability
• 2.2. Common Threats: Malware families, Phishing, Social Engineering
• 2.3. Attack Types: DoS, MitM, SQL Injection, XSS overview
• 2.4. MITRE ATT&CK Framework: Tactics, Techniques & Procedures
• 2.5. Cyber Kill Chain & Diamond Model of Intrusion Analysis
• 2.6. Security Frameworks: NIST, ISO 27001, CIS Controls overview
• 2.7. Authentication, Authorization & Access Control basics
• 2.8. Encryption fundamentals: Symmetric, Asymmetric, Hashing

Understand how attackers think — common threats, attack types, and the MITRE ATT&CK framework that maps adversary behavior to detection strategies.

Knowing the attacker's playbook is what separates a reactive analyst from a proactive defender. MITRE ATT&CK is the universal language of threat detection.

• 3.1. Windows processes, services & registry basics
• 3.2. Windows Event Log architecture (Security, System, Application)
• 3.3. Key Event IDs: 4624/4625 (logon), 4688 (process), 4720 (user created)
• 3.4. Sysmon installation & enhanced logging
• 3.5. Linux for analysts — permissions, auth logs, syslog
• 3.6. Log parsing with PowerShell & grep/awk
• 3.7. Building log analysis queries & timelines
• 3.8. Hands-on lab: Investigate suspicious logon events

Read Windows Event Logs, Sysmon traces, and Linux logs like a real SOC analyst — identify suspicious logons, process creation, and persistence.

Logs are the raw material of every SOC investigation. Knowing which event IDs matter and where attacks hide in log data is the foundation of detection.

• 4.1. SOC Structure: L1, L2, L3 analyst roles & responsibilities
• 4.2. Alert triage workflow — true positive vs false positive
• 4.3. Ticketing systems & SLAs in SOC operations
• 4.4. Investigation playbooks — phishing, malware, unauthorized access
• 4.5. TheHive: Case management & alert tracking
• 4.6. Shift handover & documentation best practices
• 4.7. Blue Team mindset: Defense-in-depth strategy
• 4.8. Hands-on lab: Triage 10 alerts from a simulated SOC queue

Master SOC operations — alert triage, playbook-driven investigation, ticketing, and the daily workflow of an L1/L2 analyst.

SOC operations is where the rubber meets the road. Understanding alert triage, SLAs, shift handovers, and professional documentation is what separates a trained analyst from a hobbyist.

• 5.1. SIEM Architecture: Data collection, indexing, correlation
• 5.2. Splunk: Installation, data inputs, source types
• 5.3. SPL Queries: Search, stats, timechart, transaction
• 5.5. Wazuh: Agent deployment, rule configuration
• 5.6. Wazuh decoders & custom detection rules
• 5.7. Correlation rules: Linking events across sources
• 5.8. Hands-on lab: Build a threat detection dashboard

Deploy Splunk and Wazuh SIEM platforms, write SPL queries, build detection dashboards, and create custom correlation rules for real-time threat monitoring.

SIEM is the SOC analyst's primary weapon. Splunk and Wazuh are the most deployed platforms — mastering them makes you immediately hireable.

• 6.1. Incident Response lifecycle: Preparation, Detection, Containment, Eradication, Recovery
• 6.2. Phishing investigation: Header analysis, URL detonation, IOC extraction
• 6.3. Brute-force & credential stuffing attack analysis
• 6.4. Web application attack detection (SQLi, XSS, directory traversal)
• 6.5. Evidence preservation & chain of custody basics
• 6.6. Escalation & communication — when L1 hands off to L2
• 6.7. Writing professional incident reports
• 6.8. Hands-on lab: Investigate a phishing campaign end-to-end

Investigate real attacks SOC analysts face weekly — phishing, brute force, web attacks — and respond using the full incident response lifecycle with professional documentation.

The attacks you investigate here are the exact same ones you will face in your first SOC job — mastering the response workflow now means confidence on day one.

• 7.1. Threat Intelligence: Strategic, Tactical, Operational, Technical
• 7.2. IOC types: IP, domain, hash, URL — collection & enrichment
• 7.3. VirusTotal, AbuseIPDB, Shodan — hands-on lookups
• 7.4. MITRE ATT&CK mapping for threat hunting
• 7.5. Vulnerability scanning with Nessus & OpenVAS
• 7.6. CVSS scoring & remediation prioritization
• 7.7. Threat hunting hypotheses & proactive detection

Enrich investigations with threat intelligence — IOC lookups, VirusTotal analysis, MITRE ATT&CK mapping, and vulnerability scanning with Nessus.

Threat intelligence separates a ticket-closing analyst from a strategic defender. The ability to contextualize alerts with IOCs and ATT&CK mapping is what gets you promoted.

• 8.1. Endpoint Detection & Response (EDR) concepts & architecture
• 8.2. Process tree analysis — parent-child relationships
• 8.3. Persistence mechanisms: Registry keys, scheduled tasks, services
• 8.4. Malware triage workflow: Static vs Dynamic analysis
• 8.5. Safe malware analysis with Any.Run & sandboxes
• 8.6. Yara rules & signature-based detection basics

Master endpoint security — EDR architecture, process analysis, persistence mechanisms, and safe malware triage workflows using sandboxes.

Endpoint security is where most attacks are ultimately caught. Understanding process trees, persistence, and safe analysis workflows makes you a complete defender.

• 9.1. Full SOC simulation — multi-day attack scenario
• 9.2. Incident report writing — professional documentation
• 9.3. Certification roadmap — CompTIA Security+, SC-200, Splunk
• 9.4. Resume & LinkedIn optimization for SOC roles
• 9.5. Mock interviews — scenario-based SOC questions
• 9.6. Job market coaching — where to apply, referrals
• 9.7. Portfolio review & career growth path
• 9.8. TryHackMe rooms & CTF challenges for skill validation

The grand finale — prove you can do the job with a full SOC simulation, then prepare for interviews and placement.

The capstone module transforms your skills into a portfolio. Complete an end-to-end SOC simulation and write professional incident reports that hiring managers respect.

• Full SOC shift simulation with live alerts
• Complete SOC simulation
• Threat hunting exercise with SIEM data
• Incident investigation reports
• Final SOC Analyst Certification

Complete 2 SOC investigation projects for portfolio. Showcase real incident response, threat detection, and SIEM skills to employers.