SOC Analyst Training with Hands-on to SIEM

Course Overview:

The Cyberfox Train SOC Analyst Training with Hands-on to SIEM program is designed to equip cybersecurity enthusiasts and professionals with the knowledge and practical skills required to excel in the role of a Security Operations Center (SOC) Analyst. This comprehensive training program covers everything from the fundamentals of cybersecurity to advanced SIEM (Security Information and Event Management) tools, providing participants with a solid foundation in threat detection, incident response, and network security monitoring.

Objective:

The primary objective of this training program is to empower individuals with the expertise needed to become proficient SOC Analysts. Participants will gain hands-on experience working with SIEM solutions, learn to identify and respond to security incidents, and develop the critical thinking and analytical skills required to protect organizations from cyber threats effectively.

Course Outcome:

By the end of the SOC Analyst Training with Hands-on to SIEM program, participants will be able to:

1. Understand the key principles of cybersecurity and the role of a SOC Analyst.
2. Utilize industry-standard SIEM tools to monitor network activities and analyze security events.
3. Detect, investigate, and respond to security incidents promptly and effectively.
4. Develop incident response plans and strategies to mitigate cyber threats.
5. Collaborate with cross-functional teams to strengthen an organization’s security posture.

Target Audience: This program is ideal for:

• Aspiring cybersecurity professionals seeking to enter the field of SOC analysis.
• Current SOC Analysts looking to enhance their skills and advance their careers.
• IT professionals interested in transitioning into the cybersecurity domain.
• Individuals committed to protecting organizations from cyber threats.

Course Module

Module 00: SOC Essential Concepts

• Computer Network Fundamentals
• TCP/IP Protocol Suite
• OSI Model & TCP IP Protocol Suite
• Network Security Devices
• Windows and Linux Security
• Web Application Architecture
• Hands-On Secure Network Setup
• Hands-On Firewall Implementation on Network

Module 01: Security Operations and Management

• Security Operations
• Security Operations Center (SOC)
• SOC Capabilities
• SOC Operations
• Components of SOC: People, Process, and Technology
• People, Technology, and Processes
• Types of SOC Models
• SOC Maturity Models
• SOC Implementation
• SOC Key Performance Indicators (KPI) and Metrics
• Challenges in the Implementation of SOC
• Best Practices for Running SOC
• SOC vs NOC

Module 02: Understanding Cyber Threats, IoCs, and Attack Methodology

• Cyber Threats and Case Study
• Tactics-Techniques-Procedures (TTPs)
• Hands-on Live Cases with the Use of TTP
• Network-Level Attacks – Demo
• Host Level Attacks – Demo
• Application-Level Attacks – Demo
• Email Security Threats – Demo
• Indicators of Compromise (IoCs)
• Attacker’s Hacking Methodology -Demo
• Hands-On IoCs Creation and Finding Other IoCs.

Module 03: Incidents, Events, and Logging

• Incident, Event and Log
• Typical Log Sources
• Need of Log
• Logging Requirements
• Typical Log Format
• Logging Approaches
• Local Logging
• Centralized Logging
• Hands-on Log Analysis
• Hands-on Log Malicious Activity Analysis
• Hands-on Manual and Automatic Logs Analysis

Module 04: Incident Detection with Security Information and Event Management (SIEM)

• Security Information and Event Management (SIEM)
• Security Analytics
• Need for SIEM
• Typical SIEM Capabilities
• SIEM Architecture and Its Components
• SIEM Solutions and SIEM Deployment
• Incident Detection with SIEM
• Handling Alert Triaging and Analysis
• Hands-on Implementation of Open Source SIEM.

Module 05: Enhanced Incident Detection with Threat Intelligence

• Cyber Threat Intelligence (CTI)
• Objectives of Threat Intelligence
• How can Threat Intelligence Help Organizations?
• Types of Threat Intelligence
• Threat Intelligence Strategy
• Threat Intelligence Sources
• Threat Intelligence Lifecycle
• Cyber Threat Analyst Responsibilities
• Threat Intelligence Platform (TIP)
• Additional Threat Intelligence Platforms
• How Threat Intelligence Helps SOC
• Benefits of CTI to SOC Team
• Benefit of Threat Intelligence to SOC Analyst
• Hands-on Threat Intelligence Use Cases for SOC Analyst
• Threat Intelligence Use Cases in SOC
• Integration of Threat Intelligence into SIEM
• Threat Intelligence Use Cases for Enhanced Incident Response
• Incident Response by Establishing SOPs for Threat Intelligence

Module 06: Incident Response

• Incident Response
• Incident Response Team (IRT)
• Where Does IRT Fit in the Organization?
• SOC and IRT Collaboration
• Incident Response (IR) Process Overview
• Step 1: Preparation for Incident Response
• Step 2: Incident Recording and Assignment
• Step 3: Incident Triage
• Step 4: Notification
• Step 5: Containment
• Step 6: Evidence Gathering and Forensic Analysis
• Step 7: Eradication
• Step 8: Recovery
• Step 9: Post-Incident Activities
• Responding to Network Security Incidents – Hands-on
• Responding to Application Security Incidents – Hands-on
• Responding to Email Security Incidents – Hands-on
• Responding to an Insider Incidents – Hands-on
• Responding to Malware Incidents – Hands-on