A 40-hour practical training pathway that turns cybersecurity fundamentals into SOC L1 alert triage, SIEM investigation, log analysis, phishing handling, threat intelligence, incident response, reporting, and escalation skills.
This SOC Analyst L1 course upgrades a cybersecurity fundamentals programme into a role-focused Security Operations Center training pathway. Learners move from core security, operating system, networking, and Linux concepts into practical alert triage, SIEM investigation, log analysis, phishing handling, endpoint monitoring, threat intelligence, incident response, AI-aware security practices, documentation, and escalation.
The course uses safe lab scenarios, sample logs, guided demonstrations, case studies, and a final SOC shift simulation to prepare learners for entry-level analyst responsibilities.
| Total learning | 40 hours |
|---|---|
| Level | Foundation to job-ready SOC L1 |
| Training mode | Classroom / Online / Hybrid |
| Learning style | Safe lab scenarios, sample logs, guided demonstrations, case studies, and SOC shift simulation |
| Certificate | Course completion certificate subject to successful completion |
By the end of the programme, learners should understand SOC operations and be able to document, triage, enrich, and escalate common security alerts.
Explain how a SOC operates, what L1 analysts handle, and how events, alerts, incidents, severity, priority, and escalation work.
Analyze basic Windows, Linux, firewall, web, DNS, proxy, endpoint, and email logs using SIEM-style investigation workflows.
Enrich indicators, map alerts to MITRE ATT&CK, prepare SOC tickets, escalation notes, and shift handover summaries.
The programme focuses on safe, controlled investigation work using representative logs, alert samples, templates, and guided security operations workflows.
Training SIEM or SIEM-like lab environment for alert queues, dashboards, triage, and investigation notes.
Windows Event Viewer, Linux authentication logs, firewall, DNS, proxy, web server, VPN, and endpoint alert samples.
IP, domain, URL, hash, CVE, and reputation lookup workflows with evidence validation and context building.
AI-assisted investigation worksheet with privacy, accuracy, verification, and responsible usage guidelines.
Thirteen modules move learners from SOC foundations to log analysis, escalation, reporting, AI-aware workflows, and a final capstone simulation.
SOC purpose, business value, analyst responsibilities, SOC L1/L2/L3 roles, security goals, defense-in-depth, event vs alert vs incident, ethics, confidentiality, and scenario classification.
Windows and Linux from a monitoring perspective, users, permissions, services, processes, startup locations, scheduled tasks, host evidence, suspicious activity, and endpoint hardening basics.
LAN, WAN, VPN, internet edge, DMZ, cloud, IP addressing, DNS, DHCP, ARP, NAT, routing, common protocols, traffic behavior, firewall, IDS, IPS, proxy, and detection concepts.
SOC operating model, alert queues, case ownership, escalation, closure, SLA basics, SIEM, EDR, NDR, firewall, email security, vulnerability scanner, ticketing tools, severity, priority, and false positives.
Windows security logs, successful and failed logons, privileged logons, account changes, process creation, PowerShell monitoring, brute force, password spraying, unusual login patterns, and Active Directory monitoring basics.
Linux directories, users, permissions, services, processes, cron, package activity, auth logs, sudo activity, SSH authentication, persistence clues, EDR alerts, and investigation notes.
Firewall allow/deny logs, source-destination analysis, geo context, repeated connection attempts, scanning, suspicious outbound traffic, DNS, proxy, web logs, injection attempts, path traversal, suspicious user agents, and OWASP monitoring.
Phishing, business email compromise, credential theft, malicious links, attachments, email headers, SPF, DKIM, DMARC, reply-to mismatches, malware types, file hash, URL, domain, and sandbox report interpretation.
Threat intelligence types, IOC vs behavioral indicators, IP, domain, URL, email, hash, user account, host enrichment, CVE, CVSS, exploitability, asset criticality, and enrichment worksheets.
Incident response lifecycle, L1 analyst actions before escalation, evidence handling, timestamps, screenshots, log excerpts, chain-of-custody awareness, MITRE ATT&CK mapping, and escalation notes.
SOC writing, facts, timeline, affected asset, user, indicators, impact, action taken, ticket quality checklist, escalation summaries, shift handover, pending action tracking, and professional communication.
AI basics, machine learning, generative AI, LLMs, automation, AI in SOC workflows, alert summarization, log explanation, IOC research, report drafting, AI-assisted phishing risks, deepfakes, prompt safety, privacy, hallucination awareness, and verification.
End-to-end SOC L1 simulation with endpoint, authentication, email, and network alerts, triage, enrichment, correlation, severity assignment, escalation decision, written incident summary, knowledge test, interview preparation, resume guidance, and next-step roadmap.
Learners complete module knowledge checks, hands-on log analysis and alert triage labs, phishing and IOC enrichment worksheets, SOC ticket writing, escalation notes, and a final SOC L1 simulation with case report. After successful completion, participants may receive a Course Completion Certificate in SOC Analyst L1.
Learners receive a simulated SOC alert queue containing authentication, endpoint, email, network, and web alerts. They must triage each alert, enrich indicators, identify likely false positives, prioritize suspicious activity, map at least one alert to MITRE ATT&CK, and prepare a clear escalation report.
Transforms cybersecurity fundamentals into practical SOC L1 responsibilities and investigation habits.
Covers SIEM, logs, phishing, endpoint, network, web, threat intelligence, and incident workflows.
Introduces AI impact, AI-enabled risks, and responsible AI use for SOC analysts.
Includes structured hands-on labs and a final controlled SOC shift simulation.
