Certified Security Operation Centre Analyst
Target Students
SOC analysts, security professionals, and IT personnel responsible for monitoring, detecting, and responding to security incidents within a Security Operations Center.
Duration : 40 hours (5 days)
Learning Objectives
Develop skills in monitoring and analyzing security events.
Learn to detect, investigate, and respond to cybersecurity incidents.
Understand SOC tools and technologies, including SIEM, IDS/IPS, and endpoint security solutions.
Gain experience with real-world incident response scenarios and threat hunting.
Master the fundamentals of threat intelligence and its application in a SOC environment.
Exam Codes : CNST-905
Exam Duration : 2 hours
Exam Formats : 100 multiple-choice questions
Exam Options : Online , In-Person
Passing Score : 70%
Course Outline
Foundations of SOC Operations
Module 1 : Introduction to SOC Analyst Role
Overview of SOC Operation
Understanding the Role and Responsibilities of a SOC Analyst
The Importance of SOC in Organizational Cybersecurity
SOC Maturity Models and Analyst Development Paths
SOC Tools and Technologies
Introduction to Key SOC Tools: SIEM, IDS/IPS, Endpoint Detection and Response (EDR)
Overview of Network Security Architecture and Monitoring Tools
Case Study: The Role of SOC Analysts in Incident Detection
Module 2 : Monitoring and Threat Detection
Network Traffic Monitoring
Basics of Network Traffic Analysis: Packet Capture, Protocol Analysis, and Traffic Flow
Using Wireshark and Network Analysis Tools for Traffic Monitoring
Implementing IDS/IPS for Network Threat Detection
Case Study: Network Traffic Analysis in a SOC Environment
Log Analysis and SIEM Management
Introduction to Log Management: Collection, Normalization, and Analysis
Configuring and Managing SIEM Systems: Log Correlation, Alerting, and Reporting
Case Study: SIEM Implementation for Enterprise Security Monitoring
Incident Response and Threat Hunting
Module 3 : Incident Response Fundamentals
Developing an Incident Response Plan
Key Components of an Incident Response Plan: Preparation, Detection, Containment, Eradication, Recovery
Incident Response Team Roles and Responsibilities
Case Study: Developing and Implementing an Incident Response Plan in a SOC
Handling Security Incident
Steps for Containing and Mitigating Security Incidents
Forensic Analysis of Compromised Systems
Case Study: Incident Response for a Phishing Attack
Module 4 : Threat Hunting Techniques
Introduction to Threat Hunting
Objectives, Methodologies, and Tools for Proactive Threat Hunting
Setting Up a Threat Hunting Environment
Developing Threat Hunting Hypotheses and Playbooks
Case Study: Conducting a Threat Hunt in a Corporate Network
Advanced Threat Hunting
Techniques for Proactive Threat Hunting: Indicators of Compromise (IoCs), Anomalous Behavior, and TTPs
Using EDR Tools for Threat Hunting
Case Study: Threat Hunting in a Real-World SOC Environment
Advanced SOC Analyst Skills
Module 5 : Malware Analysis and Detection
Basics of Malware Analysis
Introduction to Static and Dynamic Analysis Techniques
Detecting Malware in Network Traffic and Host Systems
Case Study: Analyzing a Malware Incident in a Corporate Network
Advanced Detection Techniques
Identifying and Mitigating Advanced Persistent Threats (APTs)
Using Threat Intelligence Feeds for Enhanced Detection
Case Study: Detecting and Responding to an APT in a SOC
Module 6 : Endpoint Security and Defense
Implementing Endpoint Security Solution
Overview of EDR, Antivirus, and Application Whitelisting
Protecting Endpoints from Advanced Threats: Ransomware, Fileless Malware, and Exploits
Case Study: Implementing EDR in a SOC Environment
Defensive PowerShell Scripting
Using PowerShell for Defensive Security: Monitoring, Detection, and Response
Writing Scripts for Automating SOC Tasks
Case Study: Automating Incident Response with PowerShell Scripts
SOC Reporting and Continuous Improvement
Module 7 : SOC Reporting and Metrics
Writing Effective SOC Report
Documenting Incidents, Findings, and Recommendations
Creating Executive Summaries and Technical Reports
Case Study: Reporting on a Major Security Incident in a SOC
Continuous Monitoring and Improvement
Establishing Continuous Monitoring Programs in a SOC
Implementing Security Metrics and KPIs for SOC Performance Improvement
Case Study: Continuous Improvement in a SOC Environment
Module 8 : Compliance and Regulatory Requirements
Overview of Key Cybersecurity Regulations
Understanding GDPR, HIPAA, PCI-DSS, and NIST Compliance Requirements
Ensuring SOC Operations Comply with Regulatory Frameworks
Case Study: Achieving and Maintaining Compliance in a SOC
Exam Preparation and Review
Review of Key Concepts and Techniques Covered During the Course
Sample Exam Questions and Group Discussions
Final Q&A Session and Wrap-Up
Practical Application and Capstone Project
Module 9 : Hands-On SOC Analyst Simulation
End-to-End SOC Analyst Exercise
Participants Execute Full SOC Operations: Monitoring, Detection, Incident Response, and Reporting
Real-World Scenario Simulation: Defending a Corporate Network Against Simulated Attacks
Peer Review and Instructor Feedback on SOC Analyst Performance
Advanced SOC Analyst Techniques
Exploring Cutting-Edge SOC Analyst Techniques: AI-Driven Threat Detection, Automation of SOC Operations
Case Study: Implementing Advanced Techniques in a Live SOC Environment
Module 10 : Capstone Project and Exam Preparation
Capstone Project
Participants Work on a Comprehensive Capstone Project that Encapsulates All Skills Learned Throughout the Course
Focus on Real-World Application, Reporting, and Analysis
Peer Review and Presentation of Capstone Project
Exam Preparation and Review
Review of Key Concepts and Techniques Covered During the Course
Sample Exam Questions and Group Discussions
Final Q&A Session and Wrap-Up