Cybersecurity (SOC OPS, Cloud Security)

You can configure core network protocols, evaluate the CIA triad for common IT setups, and establish a defender's baseline in Windows and Linux operating systems.

1. The CIA triad and core security principles120 min
   • Confidentiality, Integrity, and Availability controls
   • Defense-in-depth architectural models
   • Risk assessment and asset classification
   • Least privilege enforcement
2. TCP/IP, DNS, HTTP/S and how traffic really flows150 min
   • OSI and TCP/IP protocol stack packet analysis
   • DNS record types and tunneling vectors
   • TLS handshake inspection and certificate validation
   • Wireshark packet capture filters
3. Linux and Windows essentials for defenders150 min
   • Linux file permissions, sudoers, and auditd configurations
   • Windows registry structure and security event logs
   • Process tree inspection via Sysinternals Process Explorer
   • Bash and PowerShell command-line fundamentals
4. The cyber kill chain and attacker lifecycle90 min
   • Lockheed Martin Cyber Kill Chain phases
   • Reconnaissance and enumeration techniques
   • Initial access vectors and credential harvesting
   • Command and control (C2) channel identification
5. Building your home SOC lab90 min
   • VirtualBox and Docker hypervisor setup
   • Sysmon installation and configuration XML tuning
   • Virtual network isolation and firewall rules
   • Log forwarding agent deployment

Hands-on project: Deploy a local SOC test bed running a Linux SIEM receiver and verify packet ingestion using Wireshark and tcpdump.

You can dissect malware delivery vectors, analyze web application exploits against the OWASP Top 10, and prioritize vulnerabilities using CVE and CVSS metrics.

1. Malware families and how they spread120 min
   • Ransomware, trojan, and spyware operational characteristics
   • Packed and obfuscated binary analysis
   • Drive-by downloads and exploit kits
   • Static and dynamic analysis methodology
2. Phishing and social engineering120 min
   • Email header analysis (SPF, DKIM, DMARC failures)
   • Spear phishing and credential harvesting kits
   • Business Email Compromise (BEC) anatomy
   • User awareness telemetry tracking
3. Web attacks and the OWASP Top 10150 min
   • SQL injection and parameterized query defenses
   • Cross-Site Scripting (XSS) reflected and stored vectors
   • Server-Side Request Forgery (SSRF) and authentication bypass
   • Web Application Firewall (WAF) rule triggers
4. Network attacks and lateral movement120 min
   • Pass-the-Hash and Kerberoasting attacks
   • ARP poisoning and man-in-the-middle sniffing
   • Port scanning signatures with Nmap
   • Internal network pivot techniques
5. Vulnerabilities, CVEs and CVSS scoring90 min
   • National Vulnerability Database (NVD) ingestion
   • CVSS v3.1 base, temporal, and environmental metrics
   • Patch management prioritization matrices
   • Zero-day advisory evaluation workflows

Hands-on project: Analyze a quarantined malware sample payload in an isolated sandbox and generate a structured Indicators of Compromise (IoC) report.

You can map adversary behaviors to the MITRE ATT&CK framework and build threat-informed detection strategies using the ATT&CK Navigator.

1. Tactics, techniques and procedures (TTPs)120 min
   • Distinction between indicators and behaviors
   • MITRE ATT&CK enterprise matrix navigation
   • Sub-technique hierarchy and platform scopes
   • Threat actor profiling methodologies
2. Mapping real attacks to ATT&CK120 min
   • Deconstructing vendor threat intelligence reports
   • Attacker group campaigns and operational infrastructure
   • Execution and persistence technique isolation
   • Attribution confidence scoring
3. Threat-informed defence120 min
   • Shifting from reactive patching to adversary emulation
   • Caldera and Purple Team automation concepts
   • Validating security controls against specific TTPs
   • Prioritizing defensive gaps based on risk
4. Using the ATT&CK Navigator90 min
   • Layer creation and customization techniques
   • Scoring detections and telemetry visibility
   • Exporting and sharing threat models
   • Integrating navigator JSON with SIEM filters
5. From technique to detection90 min
   • Translating TTPs into Sigma detection rules
   • Data source requirement mapping for techniques
   • Evaluating detection coverage per adversary group
   • Documenting detection logic rationales

Hands-on project: Map a multi-stage APT intrusion scenario to MITRE ATT&CK tactics and export a custom JSON navigator layer highlighting coverage gaps.

You can parse, normalize, and query diverse security telemetry sources including Windows event logs, Sysmon, Linux syslog, and firewall traffic.

1. Windows event logs and Sysmon150 min
   • Critical Windows security event IDs (4624, 4688, 4720)
   • Sysmon process creation and network connection tracking
   • PowerShell script block logging (Event ID 4104)
   • Object access auditing configurations
2. Linux and syslog120 min
   • /var/log/auth.log and /var/log/syslog inspection
   • SSH brute-force and sudo escalation patterns
   • Auditd rule creation for critical file integrity
   • Systemd journalctl querying flags
3. Firewall, proxy and DNS logs120 min
   • Next-generation firewall traffic and threat logs
   • Web proxy access logs and user-agent anomalies
   • DNS query volume and entropy analysis
   • Blocked connection analysis workflows
4. Endpoint and cloud telemetry90 min
   • EDR agent telemetry pipelines
   • Cloud control plane activity logs
   • Container runtime and kernel audit logs
   • API access token usage tracking
5. Parsing and normalising log data90 min
   • Regular expressions for log extraction
   • JSON and Key-Value log formatting standards
   • Common Event Format (CEF) and Syslog RFC standards
   • Handling timestamp skew and timezone normalization

Hands-on project: Configure a centralized log forwarder to parse raw syslog and Windows security events into a structured schema format.

You can ingest multi-source telemetry, write robust correlation rules, and construct investigative dashboards within enterprise SIEM platforms like Splunk and Microsoft Sentinel.

1. What a SIEM does and how SOC tiers work180 min
   • SIEM architecture (collectors, search heads, indexers)
   • SOC Tier 1, Tier 2, and Tier 3 operational split
   • Ticket lifecycle and queue management workflows
   • Service Level Agreements (SLAs) for alert triage
2. Ingesting and searching logs (Splunk / Sentinel)240 min
   • Splunk Search Processing Language (SPL) fundamentals
   • Kusto Query Language (KQL) operators in Microsoft Sentinel
   • Time-charting, aggregation, and statistical functions
   • Lookup tables and external data enrichment
3. Dashboards and visualisations180 min
   • Building executive and operational security dashboards
   • Time-series anomaly visualisations
   • Geo-IP mapping for failed login attempts
   • Tokenized dashboard parameters and drill-down panels
4. Writing correlation and detection rules240 min
   • Threshold-based vs stateful correlation rules
   • Building scheduled searches and alert triggers
   • Integrating Sigma rules into SIEM query engines
   • Severity scoring and risk-based alerting
5. Tuning rules to cut false positives180 min
   • Analyzing alert fatigue and noise generation
   • Exclusion lists and service account whitelisting
   • Reference set calibration for dynamic thresholds
   • Auditing rule performance and hit rates

Hands-on project: Build a custom SIEM detection dashboard in Splunk or Microsoft Sentinel featuring three alert correlation rules and zero false-positive tuning.

You can execute daily SOC triage workflows, enrich alerts with threat intelligence feeds, and compile professional shift handovers.

1. The SOC analyst daily workflow120 min
   • Queue monitoring and unassigned alert claim protocols
   • Initial triage speed and threshold benchmarks
   • Distinguishing true positives from benign anomalies
   • Collaborating with IT operations and system owners
2. Investigating an alert step by step150 min
   • Process lineage verification on infected hosts
   • Network connection correlation with endpoint activity
   • User account behavior baseline checking
   • Establishing scope of compromise across endpoints
3. Enrichment with threat intelligence120 min
   • Querying IP reputation and hash databases (VirusTotal, AbuseIPDB)
   • Integrating STIX/TAXII feeds into SIEM queries
   • Evaluating threat actor context during triage
   • Handling false intelligence matches
4. Prioritisation and escalation90 min
   • Determining business impact of active alerts
   • Escalating from Tier 1 analyst to Tier 2 responder
   • Preserving volatile evidence during initial review
   • Emergency notification runbooks
5. Documentation and shift handover90 min
   • Writing concise, actionable investigation notes
   • Structuring professional shift handover reports
   • Tracking open un-escalated alerts across shifts
   • Metrics tracking for analyst performance

Hands-on project: Perform end-to-end triage on a simulated brute-force alert queue, enrich artifacts with VirusTotal, and draft an escalation ticket.

You can execute the NIST incident response lifecycle from containment to eradication and author comprehensive post-incident forensics reports.

1. The NIST incident-response lifecycle180 min
   • NIST SP 800-61 Rev 2 framework overview
   • Preparation, detection, containment, eradication, recovery
   • Post-incident activity and continuous improvement
   • Legal and regulatory notification triggers
2. Preparation and detection180 min
   • Incident response retainers and team readiness
   • Out-of-band communication channels during crises
   • Initial scoping and severity classification
   • Triage toolkits and forensic readiness
3. Containment strategies240 min
   • Network segmentation vs host isolation
   • EDR network containment commands
   • Preserving RAM and disk images before power-off
   • Preventing lateral movement during active breach
4. Eradication and recovery180 min
   • Root cause removal and backdoor elimination
   • Restoring from verified clean backups
   • System re-imaging and patch verification
   • Returning systems to production safely
5. Post-incident reporting and lessons learned240 min
   • Structuring forensic timeline reconstruction
   • Root cause analysis (RCA) facilitation
   • Action item tracking and control implementation
   • Executive summary vs technical report writing

Hands-on project: Run an active incident response playbook on a compromised web server: isolate the host, terminate malicious processes, extract artifacts, and write the post-mortem report.

You can design hypothesis-driven threat hunts using EDR query languages and MITRE ATT&CK intelligence to uncover undetected persistent threats.

1. Hypothesis-driven hunting120 min
   • Moving from reactive alerting to proactive searching
   • Formulating testable hypotheses from threat intel
   • Scoping hunt duration and target environments
   • Measuring hunting ROI and success metrics
2. Hunting with ATT&CK and IOCs120 min
   • Leveraging campaign reports for hunt design
   • Searching historical data for newly released IoCs
   • Pivoting from single indicator to behavioral clusters
   • Tracking adversary infrastructure reuse
3. Endpoint and network hunting150 min
   • Querying uncommon parent-child process relationships
   • Detecting anomalous beaconing intervals in network flows
   • Unusual PowerShell execution parameters
   • Registry run-key persistence sweeps
4. Using EDR and query languages120 min
   • Advanced EDR query syntax (Defender for Endpoint, CrowdStrike)
   • Filtering noisy system administration scripts
   • Stack-counting rare processes and binaries
   • Visualizing process trees for anomalies
5. Turning hunts into detections90 min
   • Converting successful hunt queries into persistent SIEM alerts
   • Refining query performance for continuous execution
   • Documenting hunting playbooks for team reuse
   • Sharing intelligence within the security community

Hands-on project: Execute a hypothesis-driven threat hunt across endpoint telemetry for living-off-the-land binaries (Lolbins) and document findings in an actionable report.

You can apply the cloud shared responsibility model, configure rigorous Identity and Access Management (IAM), and establish cloud logging guardrails.

1. The shared-responsibility model120 min
   • IaaS, PaaS, and SaaS security boundary splits
   • Customer vs cloud provider security obligations
   • Data ownership and encryption responsibility
   • Managing vendor risk in multi-cloud strategies
2. Identity and access management (IAM)150 min
   • Root account protection and MFA enforcement
   • IAM users, groups, roles, and policy structures
   • Cross-account access and assume-role mechanics
   • Privileged Access Management (PAM) in cloud
3. Network security groups and segmentation120 min
   • Virtual Private Cloud (VPC) and VNet architecture
   • Security groups and network ACL stateful rules
   • Private endpoints and NAT gateway configurations
   • Flow log activation and inspection
4. Encryption, secrets and key management90 min
   • Encryption at rest (SSE-S3, KMS) and in transit (TLS)
   • Key rotation policies and customer-managed keys (CMK)
   • Secrets management services (AWS Secrets Manager, Azure Key Vault)
   • Hardcoded credential scanning in code repositories
5. Cloud logging and monitoring90 min
   • CloudTrail, Activity Logs, and Cloud Audit Logs
   • Centralized log archiving to immutable storage
   • Cloud-native SIEM connector configurations
   • Real-time alerting on root account activity

Hands-on project: Audit an overly permissive cloud account configuration and remediate IAM policies to enforce least-privilege access across resources.

You can harden infrastructure across AWS, Azure, and GCP, deploy Cloud Security Posture Management, and mitigate cloud-specific threat vectors.

1. Hardening AWS accounts and workloads240 min
   • AWS GuardDuty and Security Hub deployment
   • S3 bucket public access block configurations
   • EC2 instance profile hardening and SSM Session Manager
   • IAM Access Analyzer auditing
2. Azure security and Microsoft Defender240 min
   • Microsoft Entra ID conditional access policies
   • Microsoft Defender for Cloud tier configurations
   • Azure Policy guardrails and compliance initiatives
   • Key Vault access control and auditing
3. GCP security and Security Command Centre180 min
   • GCP IAM service accounts and impersonation risks
   • VPC Service Controls and perimeter security
   • Security Command Center finding triage
   • Cloud Storage bucket ACL enforcement
4. Cloud Security Posture Management (CSPM)180 min
   • Automated compliance scanning against CIS benchmarks
   • Drift detection in cloud infrastructure configurations
   • Prioritizing cloud misconfigurations by exploitability
   • Integration with ticketing and CI/CD pipelines
5. Detecting and responding to cloud threats240 min
   • Compromised cloud credential triage and revocation
   • Cryptomining detection on compute instances
   • Unauthorized snapshot sharing investigations
   • Cloud incident response containment playbooks

Hands-on project: Deploy multi-cloud posture management scans across AWS and Azure, identify misconfigurations, and implement automated remediation scripts.

You can align security operations with regulatory frameworks like NIST, ISO 27001, and CIS benchmarks, and maintain audit-ready documentation.

1. Frameworks: NIST, ISO 27001 and CIS120 min
   • NIST Cybersecurity Framework (CSF 2.0)
   • ISO/IEC 27001 Information Security Management System
   • CIS Controls implementation groups (IG1, IG2, IG3)
   • Mapping operational controls to framework requirements
2. Risk assessment fundamentals120 min
   • Quantitative vs qualitative risk analysis
   • Likelihood and impact scoring matrices
   • Risk treatment strategies (mitigate, accept, transfer, avoid)
   • Maintaining organizational risk registers
3. Vulnerability management programs120 min
   • Internal and external vulnerability scanning cycles
   • Authenticated vs unauthenticated scan strategies
   • Exception management and remediation SLAs
   • Integrating scan results with asset inventories
4. Audit, evidence and reporting90 min
   • Preparing technical evidence for external auditors
   • Log retention policy compliance
   • Chain of custody documentation standards
   • Internal security audit preparation
5. Building runbooks and playbooks90 min
   • Standardizing incident response runbooks
   • Checklists for common alert escalations
   • Version control and review cycles for playbooks
   • Measuring playbook effectiveness and MTTR

Hands-on project: Draft a compliance evidence collection runbook mapping technical SIEM controls to NIST CSF and ISO 27001 annex controls.

You can write a detection rule that catches a technique with few false positives, and automate the response.

1. Detection as code90 min
   • Sigma rule structure
   • Mapping to ATT&CK
   • Version control and review
2. Tuning out the noise90 min
   • Baselining normal
   • Allow-listing safely
   • Precision vs recall
3. Validating a detection90 min
   • Atomic Red Team tests
   • Purple-team validation
   • Coverage gaps
4. Automating response90 min
   • SOAR playbook design
   • Enrichment steps
   • Where a human must approve

Hands-on project: Write and tune Sigma detections for three MITRE techniques against supplied telemetry, measure true and false positives, then automate enrichment and containment for one alert in a SOAR playbook with a human approval step.

You can execute a full-scale simulated security breach investigation, present your portfolio of hardened cloud environments, and clear SOC analyst interview loops.

1. End-to-end SOC investigation capstone240 min
   • Simulated enterprise APT attack simulation ingestion
   • Tier 1 to Tier 3 escalation execution
   • Artifact collection and timeline reconstruction
   • Live incident debrief presentation
2. Cloud-security hardening project240 min
   • Multi-account cloud security posture audit
   • Implementing least-privilege IAM and guardrails
   • Configuring centralized logging and alerting pipelines
   • Validating posture against CIS benchmarks
3. Portfolio and case documentation180 min
   • Structuring professional security GitHub portfolios
   • Writing technical case studies of investigations
   • Documenting detection rules and Sigma contributions
   • Resume tailoring for SOC analyst roles
4. SOC analyst mock interviews240 min
   • Technical log analysis and troubleshooting questions
   • Behavioral incident response scenario walk-throughs
   • Whiteboard architecture reviews for cloud security
   • Negotiating job offers and navigating HR screening
5. Certification and next steps180 min
   • Mapping skills to industry certifications (CompTIA Sec+, BTL1, GCIH)
   • Continuing education in threat intelligence and engineering
   • Joining defensive security communities
   • Final course review and credential issuance

Hands-on project: Complete the live end-to-end SOC capstone: ingest a complex multi-stage attack trace, triage alerts, contain the threat, write the forensic report, and complete a technical mock interview.