Security Operations & Threat Hunting (SOC)

SIEM Telemetry, Sigma Rules, YARA Hunting, MITRE ATT&CK & Volatile Forensics

5 modules, 24 lessons: SOC Architecture & SIEM Engineering; Log Ingestion & Detection Engineering; Threat Intelligence & MITRE ATT&CK Mapping; Incident Response Lifecycle & Playbooks; Digital Forensics & Malware Triage.

Intermediate · 3 hours · 24 lessons · 90 labs

Who it is for

Intermediate level.

For SOC analysts and IT administrators who want to triage alerts, write detections, hunt threats and handle incidents from first alert to post-incident review.

What you don't need yet:

What helps:

Before you start:

Take first:

Take next:

Learning paths:

Nobody needs to know everything before they start. Each course builds on the one before, so a learning path takes you there step by step.

Labs

90 labs, 73 of them graded: you write the code, it runs, and graded labs check the result. The outline lists each lesson's labs.

What is free

Start free: First module free with an account. Pro: Every course, lab, handbook, practice exam and certificate.

Course outline

SOC Architecture & SIEM Engineering

  1. SOC Operating Models, Tiers & Key Performance Metrics (3 labs): You can explain SOC tiers and operating models, compute detection and response times from case timestamps, and set a key risk indicator with agreed limits.
  2. Alert Triage, False Positive Reduction & Fatigue Mitigation (3 labs): You can classify alert outcomes, find the rules that fill the queue, write a scoped exclusion that does not hide attackers, and group alerts into cases.
  3. SIEM Architecture: Ingestion Pipelines & Indexing (3 labs): You can trace an event through a SIEM pipeline, decode syslog priority, and explain why field indexes and full text indexes each miss different evidence.
  4. SOC Runbooks, Shift Handoffs & Escalation Paths (3 labs): You can write a runbook with evidence, authority and escalation triggers, generate a shift handoff that flags risk, and replay a time based escalation against its target.
  5. Threat Intelligence Platforms & STIX/TAXII Ingestion (4 labs): You can relate threat actor types to their motives, read a STIX 2.1 indicator, poll a TAXII 2.1 collection incrementally, and match indicators against proxy logs with expiry.

Log Ingestion & Detection Engineering

  1. Event Correlation Rules, Thresholds & Anomaly Pipelines (5 labs): You can build threshold, correlation and baseline anomaly rules over parsed auth logs and explain what each one misses.
  2. Log Parsing, Schema Normalization (OCSF/ECS) & Extraction (6 labs): You can extract fields from text and JSON logs, map them onto ECS and OCSF, and catch the time zone and parse-failure bugs that break queries.
  3. Detection as Code: Authoring & Testing Sigma Rules (2 labs): You can read and write a Sigma rule, test it against true and false positive events, and name the log indicators behind common attack families.
  4. Windows Event Logs, Sysmon & Linux Auditd Telemetry (5 labs): You can parse Windows Security and Sysmon XML, reassemble auditd records, and write and read a Kubernetes audit policy to see who touched secrets or exec'd into pods.
  5. YARA Rule Authoring & File Signature Matching (5 labs): You can write a YARA rule with text, wide and hex strings and a condition that matches a malware family while rejecting clean files.

Threat Intelligence & MITRE ATT&CK Mapping

  1. Cyber Kill Chain vs MITRE ATT&CK Framework (4 labs): You can map one intrusion onto both the Cyber Kill Chain and MITRE ATT&CK, and explain what each view reveals and hides.
  2. Adversary Tactics, Techniques & Procedures (TTP) Mapping (3 labs): You can read raw auth, web and sign-in logs, name the attack and ATT&CK technique they prove, and tell an attempt from a success.
  3. Indicator of Compromise Extraction & Threat Hunting Feeds (4 labs): You can extract and validate indicators from a threat report, sweep real proxy and endpoint logs for them, and age a feed before it reaches your SIEM.
  4. Tracking Advanced Persistent Threats & Profiles (4 labs): You can keep an evidence-based cluster profile, resolve vendor aliases, link incidents through infrastructure and weighted technique overlap, and state attribution confidence honestly.
  5. Detecting Persistence: Tasks, Registry & Services (5 labs): You can find scheduled task, service and Run key persistence in Windows event XML, diff autostarts against a baseline, and spot Kubernetes persistence in API server audit logs.

Incident Response Lifecycle & Playbooks

  1. NIST SP 800-61 Incident Lifecycle & Management (3 labs): You can place each action in an incident on its NIST lifecycle phase, spot when new scope sends a case back to analysis, measure the incident's clocks from its timeline, and explain how training, tabletops and simulations test preparation.
  2. Incident Triage, Severity Scoping & Communication (3 labs): You can scope an incident by following an attacker's logins across hosts, rate its severity from NIST's impact factors using a written mapping, and run stakeholder communication out of band with legal owning regulatory clocks.
  3. Containment & Eradication: Host, Net & Identity (3 labs): You can choose a containment strategy, isolate a host without leaving live attacker sessions open, show why revoking sessions and not a password reset stops a stolen token, and sweep every in-scope host before a single coordinated eradication.
  4. Recovery & System Validation Testing (2 labs): You can choose a restore point that predates the attacker and prove it intact, gate a rebuilt host's reconnection on a scripted baseline, and weigh the benefits and costs of automating that recovery work.
  5. Post-Incident Review & Root Cause Analysis (5 labs): You can run a blameless review from the incident timeline, find branching root causes with five whys and a fishbone, and prove a corrective detection works by replaying the incident's own logs through it.

Digital Forensics & Malware Triage

  1. Forensics Principles, Custody & Imaging (4 labs): You can decide what to collect first, acquire a disk image whose hashes prove it is unchanged, and keep a chain of custody with no gaps.
  2. Disk Forensics: MFT, UsnJrnl & Prefetch (3 labs): You can parse MFT records and USN journal entries exported from an image, spot timestomping, and say what Prefetch adds as evidence of execution.
  3. Memory Forensics: Process Trees & Injection (3 labs): You can read a process tree from a memory image for impossible parents, and pick out injected code by its memory protection, missing file backing and first bytes.
  4. Malware Triage: Hashes, Strings & Sandboxing (5 labs): You can handle a suspicious file as evidence, triage it with hashes, strings and its import table, and sweep endpoint logs for the indicators it yields.

Certification courses