Build the practical skills to monitor security events, investigate alerts, hunt threats, and coordinate enterprise incident response.

SOC Analyst Track

Install and register Wazuh Agent on the Linux target host

Start and enable Wazuh agent service

Trigger a simulated brute-force authentication event

Lab 1.1: Deploying and Ingesting Logs into Wazuh SIEM

Open learning video tutorial introducing Tier 1-3 SOC workflows, SIEM ingestion, and incident triage fundamentals.

SOC Analyst Training - Introduction to Security Operations Center

The globally recognized standard for incident response organization and lifecycle management.

NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide

Curated knowledge base and model for cyber adversary behavior, tactics, and techniques.

MITRE ATT&CK Enterprise Matrix

Complete architecture and implementation guides for open-source XDR and SIEM.

Wazuh Official Documentation & Lab Guides

Understand enterprise SOC operations, tier escalation models (Tier 1 Triage, Tier 2 Incident Response, Tier 3 Threat Hunting), SIEM log ingestion architectures, and key operational metrics (MTTD & MTTR).

Modern SOC Architecture, Alert Lifecycle & SIEM Fundamentals

How Computer Systems Work | Cybersecurity Fundamentals for Beginners

Open PowerShell as Administrator and export Sysmon Process Creation events

Filter specifically for encoded PowerShell execution strings

Decode base64 payload safely in PowerShell

Lab 2.1: Hunting Obfuscated PowerShell via Sysmon and Event Viewer

Open learning video breakdown of critical Event IDs (4624, 4625, 4688, 7045) and Sysmon process telemetry.

Windows Event Logs for SOC Analysts & Sysmon Deep Dive

Complete reference for every Windows Security Event ID with expert analysis.

Ultimate Windows Security: Event ID Encyclopedia

Industry-standard baseline configuration for Microsoft Sysmon.

SwiftOnSecurity Sysmon Config Template

Visual blueprint for identifying anomalies in Windows processes and services.

SANS Poster: Hunt Evil - Windows Artifact Analysis

Deep-dive into Windows Security Event IDs (4624, 4625, 4688, 4697, 7045) and Microsoft Sysmon telemetry (Process Creation, Network Connections, Process Injection).

Windows Event Log & Sysmon Deep Dive

SOC Architecture, Roles and Triage Workflow | SOC Analyst Training

Open packet capture and examine DNS protocol distribution

Extract top queried domains and detect high-entropy subdomains

Pinpoint the infected internal host IP address

Lab 3.1: Investigating a Cobalt Strike DNS C2 Channel in Wireshark

Open tutorial covering display filters, TCP handshake inspection, and DNS beaconing detection.

Wireshark Packet Analysis Tutorial for Beginners

Comprehensive reference manual for deep network protocol analysis.

Wireshark Official User Guide

Real-world PCAP repository covering recent banking trojans, ransomware, and exploit kits.

Malware-Traffic-Analysis.net (Brad Duncan)

Open-source operational network analysis framework used in enterprise SOCs.

Zeek Network Security Monitor

Inspect live and captured network traffic using Wireshark and tcpdump. Identify protocol anomalies, DNS tunneling, cleartext credential leaks, and C2 beacons.

Network Traffic Analysis & Packet Inspection

Network Traffic Analysis & Wireshark Packet Inspection

Inspect malicious command line syntax

Convert detection YAML to Splunk SPL using pySigma

Lab 4.1: Authoring a Sigma Rule and Translating to Wazuh/Splunk

Open learning session demonstrating Splunk SPL query authoring and vendor-neutral Sigma rule compilation.

Writing Splunk Search Processing Language & Sigma Rules

The official collection of open-source generic detection rules for all platforms.

SigmaHQ Official Rules Repository

Authoritative cheat sheet for search syntax, commands, and functions.

Splunk Quick Reference Guide (SPL)

Craft custom detection rules using Splunk Search Processing Language (SPL) and cross-platform Sigma formats. Learn alert baseline tuning and false positive reduction.

Detection Engineering, Sigma Rules & Splunk SPL

Execute host network isolation command

Verify network isolation status

Lab 5.1: Executing Host Containment via EDR CLI Scripting

Open tutorial walking through the 6 phases of NIST incident handling and host isolation scripting.

NIST SP 800-61 Incident Response & Host Isolation Playbooks

Battle-tested federal operational playbooks for incident handling and vulnerability mitigation.

CISA Incident Response Playbooks

Step-by-step practical incident responder field manual.

The SANS Incident Handler's Handbook

Implement repeatable incident response playbooks for Ransomware, Business Email Compromise (BEC), and Credential Theft. Execute rapid host isolation and credential revocation.

Incident Triage, Containment Playbooks & MITRE Mapping

Incident Triage, Containment Playbooks & MITRE ATT&CK Mapping

Identify initial access vector via mail gateway and endpoint logs

Extract C2 IP and establish timeline of data staging

Capstone Lab: The Falcon Bank Intrusion Investigation

Open walkthrough of a full kill-chain incident investigation and IOC reporting for SOC defenders.

SOC Capstone Incident Investigation & Executive Reporting

Standard professional template for documenting enterprise cybersecurity incidents.

TrustStack Official Incident Triage Template

Curated blue team challenges and digital investigations.

CyberDefenders Free Practice Labs

Synthesize all skills in a realistic end-to-end incident scenario. Investigate a full kill-chain compromise from phishing email to domain escalation, extract IOCs, and deliver an executive incident report.

Capstone: Live SOC Incident Investigation & Executive Briefing

Comprehensive guide to hypothesis-driven, baseline, and model-assisted hunting.

The PEAK Threat Hunting Framework

Authoritative library of native Windows binaries used by adversaries for stealthy operations.

LOLBAS Project: Living Off The Land Binaries and Scripts

Standardized target-hunting framework for enterprise banking operations.

TaHiTI: Threat-Hunting Methodology

Master the proactive threat hunting lifecycle. Formulate actionable hypotheses using MITRE ATT&CK, baseline enterprise network anomalies, and hunt for stealthy Living-off-the-Land (LOLBins) adversaries before alerts fire.

Enterprise Threat Hunting Methodology & Hypothesis-Driven Investigation

Enterprise Threat Hunting Frameworks & Hypothesis Formulation

Official guide on cloud log triage, forensic isolation, and automated incident containment.

AWS Security Incident Handling Guide

Architectural blueprint for modernizing SOC workflows with Azure Sentinel and Defender.

Microsoft Cloud Adoption Framework: SOC Operations

Empirical analysis of real-world cloud intrusions, API credential theft, and IAM persistence.

Cloud Threat Report: Adversary TTPs in Cloud Environments

Navigate the architectural realities of cloud-native and hybrid SOC monitoring. Correlate AWS CloudTrail, Microsoft Entra ID, and SaaS audit streams to detect identity plane compromise, API token theft, and cross-cloud persistence.

Cloud & Hybrid SOC Operations (AWS, Azure & SaaS Telemetry)

Cloud-Native SOC Architecture & Identity Plane Defense

Definitive multi-agency guide on ransomware prevention, response checklists, and technical mitigations.

CISA #StopRansomware Guide

Detailed mappings of privilege escalation, defense evasion, and impact techniques used by ransomware gangs.

MITRE ATT&CK: Enterprise Ransomware Techniques

Architectural guidelines for protecting enterprise storage and backup systems from ransomware destruction.

NIST SP 800-209: Security Guidelines for Storage Infrastructure

Deconstruct the multi-stage ransomware kill chain from initial access brokers to double extortion. Build defensible containment protocols, manage out-of-band communications, and coordinate multi-team enterprise crisis response.

Ransomware Defense Operations, Playbooks & Incident Coordination

Ransomware Triage, Blast-Radius Containment & Crisis Management

Benchmark capabilities, integration criteria, and operational models for enterprise SOAR platforms.

Gartner Market Guide for Security Orchestration, Automation and Response (SOAR)

Standard machine-to-machine threat indicator communication protocol.

CISA Automated Indicator Sharing (AIS)

Best practices for writing high-fidelity alert rules with minimal false positives.

The Architecture of Detection Engineering & Alert Tuning

Scale SOC operations through Security Orchestration, Automation, and Response (SOAR). Design robust automated enrichment playbooks, implement error-handling logic, and aggressively reduce analyst alert fatigue.

SOAR Engineering, Automated Playbook Design & False-Positive Tuning

Building Enterprise SOAR Playbooks & Metric-Driven Alert Tuning

Official legal text outlining data controller duties, breach notification protocols, and penalties.

Nigeria Data Protection Act (NDPA 2023) Official Gazette

Global standard for digital forensic readiness and defensible evidentiary procedures.

ISO/IEC 27037: Guidelines for Identification, Collection, Acquisition and Preservation of Digital Evidence

Mandatory 4-day disclosure framework for material corporate cyber incidents.

SEC Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure

Navigate legal compliance, data protection mandates, and defensible evidence handling. Master breach reporting deadlines under the Nigeria Data Protection Act (NDPA 2023), GDPR, and SEC disclosure rules.

Regulatory Reporting, Evidentiary Preservation & Compliance Hand-off

Regulatory Incident Timelines, Evidentiary Chain of Custody & Legal Hand-off

The global gold-standard self-assessment model for measuring SOC operational maturity.

SOC-CMM: The Security Operations Center Capability Maturity Model

The classic 'Ten Strategies of a World-Class Cybersecurity Operations Center' roadmap.

Building a World-Class Security Operations Center

Annual benchmarks on analyst salaries, turnover rates, retention strategies, and tooling investments.

SANS Institute: SOC Survey on Staffing and Metrics

Elevate from operational analysis to strategic blue team leadership. Master SOC maturity frameworks (SOC-CMM), analyst shift ergonomics, return on investment (ROI) articulation, and executive board reporting.

Continue learning, Showcase.

How Computer Systems Work | Cybersecurity Fundamentals for Beginners

How Computer Systems Work | Cybersecurity Fundamentals for Beginners

1. The Structure of a Modern Security Operations Centre

SOC Analyst Tier Hierarchy:

Key Performance Indicators (KPIs):

Verified Career Badge