Course Objective & Scope
A SIEM that ingests noisy logs without clear data onboarding, normalization and correlation logic quickly overwhelms analysts with alert fatigue. This programme covers the modern SOC operating model, mapping log sources to threat visibility, query and correlation rule authoring, L1/L2 alert triage and hypothesis-driven threat hunting.
Working on a realistic enterprise dataset, participants query multi-source attack logs, write detection rules, tune out false positives and assemble an internal SOC triage and use-case checklist.
Who Should Attend?
- L1, L2 and L3 SOC analysts
- SIEM and detection engineering specialists
- Systems and security engineers building centralized logging and monitoring platforms
- Prerequisite: foundational knowledge of network protocols, OS logs and cybersecurity concepts
Key Takeaways
- Prioritise critical log sources (EDR, AD/IAM, firewall, DNS, proxy, cloud) against detection goals
- Parse and normalize raw logs to author correlation and behavioural detection rules
- Triage alerts rapidly using contextual enrichment (threat intelligence, asset criticality)
- Run hypothesis-driven threat hunting queries mapped to MITRE ATT&CK techniques
- Create a SOC use-case checklist that improves MTTD/MTTR and reduces false-positive rates
Curriculum
Modern SOC Architecture and Metrics
- SOC tiers (L1/L2/L3), responsibilities and detection-engineering-led workflows
- MTTD, MTTR, rule efficacy and MITRE ATT&CK coverage metrics
Log Sources, Ingestion and Normalization
- Selecting Windows/Sysmon, Linux, Active Directory, network and cloud audit logs
- Parsing, schema standardization (ECS/OCSF/CIM) and time synchronization
Correlation Rules and Use-Case Development
- Designing rules for brute-force, impossible travel, privilege escalation and lateral movement
- Sigma rules, thresholds and false-positive tuning techniques
Alert Triage and Contextual Enrichment
- Step-by-step L1/L2 alert investigation flow and IOC/TI enrichment
- Distinguishing true positives from benign administrative activity
Log-Based Threat Hunting and Reporting
- Hunting queries for stealthy activity (living-off-the-land, C2 beaconing) that bypasses static rules
- Internal SOC use-case lifecycle and triage checklist
Other Courses in This Category
-
SOAR playbooks, LLM and security agents for automated enrichment, alert triage, case summarization and human-in-the-loop response for SOC and security engineers scaling operations.
- Live Course
- 5 modules
-
Evasion, data poisoning, backdoors, model extraction and membership inference attacks and defenses under MITRE ATLAS for data science and security teams testing ML model robustness.
- Live Course
- 5 modules
-
OWASP Top 10 for LLM & Agentic Applications, direct/indirect prompt injection, RAG data leakage, MCP/tool-calling authorization and guardrail architectures for engineers building secure AI systems.
- Live Course
- 5 modules
-
ISO/IEC 27001:2022 clauses, asset and risk assessment, Annex A controls, Statement of Applicability (SoA) and internal audit readiness for teams establishing and operating an ISMS.
- Live Course
- 5 modules
-
The Linux network stack, nftables/iptables, SSH and privilege hardening, SELinux/AppArmor, auditd and packet analysis for systems and security engineers securing production Linux servers.
- Live Course
- 5 modules
-
Static and dynamic malware analysis in isolated labs, PE/ELF inspection, behavioural monitoring, unpacking, code analysis with Ghidra and YARA rule authoring for security analysts.
- Live Course
- 5 modules
Get in touch
