Cybersecurity Training: SOC Operations & Cloud Security

You can articulate the CIA triad, model threat vectors, and construct a hardened local virtual machine security sandbox.

1. The CIA triad and core security concepts120 min
   • Confidentiality controls
   • Integrity validation mechanisms
   • Availability SLA metrics
   • Risk modeling fundamentals
2. Security terminology and threat types120 min
   • Attack vectors and threat actors
   • Zero-day vulnerabilities
   • Exploit vs payload dynamics
   • Insider threat indicators
3. Defence in depth120 min
   • Perimeter vs internal controls
   • Layered security architecture
   • Compensating security controls
   • Fail-safe defaults
4. The role of a Security Operations Centre120 min
   • Tier-1 through Tier-3 escalation flow
   • SOC analyst duties and SLAs
   • Signal-to-noise ratio challenges
   • Shift handover protocols
5. Setting up your security lab120 min
   • VirtualBox and Vagrant configuration
   • Isolated host-only networking
   • Snapshot management
   • Syslog forwarder setup

Hands-on project: Deploy a hardened Ubuntu virtual machine inside a private virtual network, enforce SSH key-only access, disable root login, and document the baseline security posture.

You can dissect network traffic captures, trace TCP handshake anomalies, and spot unencrypted data exfiltration in Wireshark.

1. TCP/IP and the OSI model120 min
   • Encapsulation and decapsulation
   • TCP three-way handshake flags
   • SYN flood mechanics
   • UDP stateless communication
2. DNS, HTTP/S and TLS120 min
   • DNS tunneling signatures
   • HTTP request-response lifecycle
   • TLS handshake certificate validation
   • SNI inspection techniques
3. Ports, protocols and services120 min
   • Well-known vs ephemeral ports
   • Banner grabbing with Netcat
   • Service fingerprinting
   • Unauthenticated listening sockets
4. Packet analysis with Wireshark120 min
   • Display filters and stream following
   • Extracting files from HTTP sessions
   • Detecting ARP spoofing
   • Analyzing TCP retransmissions
5. Reading network traffic120 min
   • Baseline traffic profiling
   • Identifying beaconing intervals
   • Spike detection algorithms
   • Protocol anomaly spotting

Hands-on project: Analyze a malicious PCAP file containing a reverse shell, extract the payload indicators, and write an incident summary detailing the communication channels.

You can parse Windows Event Logs and Linux system telemetry to identify unauthorized process execution and privilege escalation.

1. Windows security and event logs120 min
   • Windows Event Log architecture
   • Security Event ID 4624 and 4688
   • PowerShell script block logging
   • WMI persistence mechanisms
2. Linux security and logs120 min
   • /var/log/auth.log analysis
   • PAM authentication failures
   • sudoers file auditing
   • Cron job persistence checks
3. Sysmon and endpoint telemetry120 min
   • Sysmon XML configuration
   • Process creation and network connection tracking
   • Image load auditing
   • Registry modification events
4. System hardening120 min
   • CIS benchmarks application
   • Disabling legacy protocols
   • Service minimization
   • File permission audits
5. Baseline and monitoring120 min
   • File integrity monitoring with AIDE
   • Process baseline comparison
   • Registry state hashing
   • Telemetry collection verification

Hands-on project: Configure Sysmon and auditd on a test host, generate malicious process trees via PowerShell execution, and extract event IDs 1 and 3.

You can map adversary behaviors to the MITRE ATT&CK framework and identify web application attack vectors from raw server logs.

1. Malware and ransomware120 min
   • Static vs dynamic analysis workflow
   • Ransomware encryption workflows
   • Command and control protocols
   • Sandbox evasion detection
2. Phishing and social engineering120 min
   • Spear phishing indicators
   • Email header analysis (SPF, DKIM, DMARC)
   • Malicious macro execution
   • Credential harvesting pages
3. Web attacks and the OWASP Top 10120 min
   • SQL injection signatures
   • Cross-site scripting (XSS) patterns
   • Broken object level authorization
   • Remote code execution vectors
4. The MITRE ATT&CK framework120 min
   • Tactics, techniques, and procedures (TTPs)
   • Navigator matrix navigation
   • Sub-technique mapping
   • Threat actor group profiling
5. The cyber kill chain120 min
   • Reconnaissance and weaponization
   • Delivery and exploitation
   • Installation and C2 stages
   • Actions on objectives disruption

Hands-on project: Map a multi-stage ransomware attack scenario across the cyber kill chain, documenting specific TTPs for initial access, execution, and exfiltration.

You can ingest raw log streams into Splunk and Microsoft Sentinel, write functional detection rules in SPL and KQL, and tune alerts to suppress false positives.

1. SIEM fundamentals240 min
   • Log collection architectures
   • Forwarder vs aggregator roles
   • Data normalization and schemas
   • Storage and retention policies
2. Log sources and ingestion240 min
   • Syslog and HTTP Event Collector (HEC)
   • Sysmon forwarding pipelines
   • CloudTrail log streaming
   • Parsing custom log formats
3. Searching and dashboards (Splunk / Sentinel)240 min
   • Search Processing Language (SPL) fundamentals
   • Kusto Query Language (KQL) syntax
   • Timechart and stats aggregations
   • Visualization panel building
4. Writing detection and correlation rules240 min
   • Threshold-based alerting
   • Sequence correlation rules
   • Risk-based alerting frameworks
   • Scheduled search automation
5. Reducing false positives240 min
   • Baseline exception handling
   • Lookup table enrichment
   • Alert tuning methodologies
   • Confidence scoring models

Hands-on project: Build a custom detection dashboard in Splunk that ingests Windows security logs and triggers an alert on pass-the-hash authentication attempts with zero false positives under load.

You can execute the standard SOC analyst triage workflow, prioritize incoming alerts against SLAs, and enrich IOCs using threat intelligence feeds.

1. The SOC analyst workflow120 min
   • Alert queue management
   • Initial triage evaluation
   • True positive vs false positive verification
   • Escalation threshold criteria
2. Alert triage and prioritisation120 min
   • Severity scoring frameworks (CVSS/EPSS)
   • Asset criticality weighting
   • SLA adherence tracking
   • Queue backlog handling
3. Threat intelligence and enrichment120 min
   • OSINT integration
   • VirusTotal and AlienVault OTX lookups
   • IP reputation checking
   • Domain age and WHOIS correlation
4. Escalation procedures120 min
   • Tier-2 notification packaging
   • Contextual evidence bundling
   • PagerDuty integration
   • Incident ticket creation standards
5. Documentation and handover120 min
   • Shift log maintenance
   • Handover briefing preparation
   • Unresolved alert tracking
   • Metric reporting templates

Hands-on project: Triage a batch of 50 simulated SIEM alerts, enrich suspicious file hashes via VirusTotal APIs, and document escalation decisions in TheHive.

You can execute full incident response lifecycles, isolate compromised endpoints, and assemble forensic evidence timelines.

1. The incident-response lifecycle240 min
   • NIST SP 800-61 framework phases
   • Preparation and scoping
   • Containment strategies
   • Post-incident review mechanics
2. Detection and analysis240 min
   • Initial breach scope assessment
   • Lateral movement identification
   • Data exfiltration confirmation
   • Evidence preservation standards
3. Containment strategies240 min
   • Network segmentation and quarantine
   • EDR host isolation commands
   • Credential revocation
   • Service suspension procedures
4. Eradication and recovery240 min
   • Malware artifact removal
   • Vulnerability patching
   • Clean system restoration from backups
   • Monitoring post-recovery stability
5. Reporting and lessons learned240 min
   • Timeline reconstruction
   • Root cause analysis (RCA)
   • Detective control improvements
   • Executive summary drafting

Hands-on project: Handle a simulated active ransomware outbreak on a test network, execute host isolation playbooks, preserve RAM dumps, and write an executive post-incident report.

You can formulate proactive hunting hypotheses, query endpoint telemetry for hidden attacker footprints, and convert findings into permanent detections.

1. Hypothesis-driven hunting120 min
   • Formulating hunting theories from threat intelligence
   • Assumptions and testing criteria
   • Scope definition
   • Validating hunt viability
2. IOCs and TTPs120 min
   • Atomic indicators vs behavioral indicators
   • Pyramid of pain application
   • Indicator aging and decay
   • YARA rule syntax basics
3. Endpoint and network hunting120 min
   • Querying unusual process ancestry
   • Uncommon outbound port analysis
   • DNS query volume anomalies
   • Unsigned driver loading detection
4. Using EDR tools120 min
   • Querying Defender for Endpoint
   • Live response sessions
   • Process memory inspection
   • Isolating hosts via API
5. Building new detections120 min
   • Converting hunt findings into Sigma rules
   • Testing rule resilience
   • Deploying rules to production SIEM
   • Measuring detection efficacy

Hands-on project: Design a hypothesis-driven threat hunt for living-off-the-land binaries (LotLB) in Windows environments, execute the query across Splunk, and author a new detection rule.

You can design least-privilege cloud IAM boundaries, secure storage buckets, and configure centralized logging across cloud infrastructure.

1. The shared-responsibility model120 min
   • IaaS, PaaS, and SaaS security boundaries
   • Customer vs provider obligations
   • Cloud data ownership principles
   • Compliance inheritance models
2. Identity and access management120 min
   • IAM policies and trust relationships
   • Cross-account role assumption
   • MFA enforcement
   • Temporary security tokens (STS)
3. Cloud network security120 min
   • Virtual Private Cloud (VPC) isolation
   • Security groups vs network ACLs
   • Private endpoints and NAT gateways
   • Flow log analysis
4. Encryption and secrets120 min
   • KMS key management policies
   • Client-side vs server-side encryption
   • Secrets Manager rotation
   • Certificate Manager workflows
5. Cloud logging and monitoring120 min
   • CloudTrail and CloudWatch configuration
   • Azure Activity Log collection
   • Centralized SIEM log shipping
   • Storage audit logging

Hands-on project: Audit an insecure AWS multi-account environment, fix over-privileged IAM roles, enable S3 bucket public access blocks, and enforce CloudTrail log integrity.

You can configure cloud-native security posture management (CSPM), detect cloud threat vectors, and automate containment playbooks.

1. Hardening cloud accounts240 min
   • Root account protection
   • AWS Organizations Service Control Policies (SCPs)
   • Azure Policy guardrails
   • Orphaned resource cleanup
2. Cloud-native security tooling240 min
   • Amazon GuardDuty finding types
   • Microsoft Defender for Cloud benchmarks
   • Security Hub posture scoring
   • Azure Sentinel cloud connectors
3. Cloud Security Posture Management (CSPM)240 min
   • Misconfiguration scanning
   • Compliance framework mapping (CIS, PCI-DSS)
   • Automated remediation scripts
   • Drift detection
4. Detecting cloud threats240 min
   • IMDSv1 abuse and credential theft
   • Unusual API call volume detection
   • Compromised EC2 instance triage
   • Azure App Service vulnerability analysis
5. Responding to cloud incidents240 min
   • Snapshotting compromised disks for forensics
   • Isolating cloud workloads via security groups
   • Revoking active IAM sessions
   • Automating response with Lambda and Azure Functions

Hands-on project: Deploy Amazon GuardDuty and Microsoft Defender for Cloud across a multi-region environment, wire alerts to automated AWS Lambda containment playbooks, and validate response times.

You can align security operations with NIST and ISO 27001 frameworks, manage vulnerability lifecycles, and maintain operational runbooks.

1. Frameworks: NIST, ISO 27001 and CIS120 min
   • NIST Cybersecurity Framework (CSF)
   • ISO/IEC 27001 annex controls
   • CIS Controls implementation groups
   • Compliance audit preparation
2. Risk and vulnerability management120 min
   • Vulnerability scanning with Nessus
   • CVSS v3.1 scoring interpretation
   • Patch management SLAs
   • Risk acceptance documentation
3. Audit and reporting120 min
   • Evidence collection for auditors
   • Log retention compliance
   • Access review cycles
   • Executive dashboard reporting
4. Runbooks and playbooks120 min
   • Standard operating procedure (SOP) design
   • Playbook automation steps
   • Checklist-driven incident handling
   • Version control for security documentation
5. Security awareness120 min
   • Phishing simulation metrics
   • Developer security training
   • Reporting suspicious channels
   • Culture of security metrics

Hands-on project: Draft an incident response runbook and vulnerability management policy aligned with NIST SP 800-53 controls for an enterprise deployment.

You can turn an attack technique into a tuned detection rule and an automated playbook.

1. Writing detections that hold up90 min
   • Sigma syntax
   • Technique-based coverage
   • Peer review of rules
2. Reducing false positives90 min
   • Establishing a baseline
   • Environment-specific exclusions
   • Measuring precision
3. Testing your own detections90 min
   • Simulating the technique
   • Verifying the alert fires
   • Documenting coverage
4. Playbooks and automation90 min
   • Triage decision tree
   • Automated enrichment
   • Containment with approval

Hands-on project: Author Sigma rules for three attack techniques seen in the course telemetry, tune them against a week of benign logs to cut false positives, and build a response playbook that enriches and contains with an approval gate.

You can execute an end-to-end SOC incident investigation and present a professional security portfolio during technical hiring loops.

1. End-to-end SOC investigation capstone240 min
   • Simulated enterprise breach execution
   • Multi-source log correlation challenge
   • Containment and eradication execution
   • Live instructor defense review
2. Cloud-hardening project240 min
   • Multi-account security architecture review
   • IAM least-privilege enforcement
   • Automated alert pipeline verification
   • Posture score optimization
3. Portfolio and documentation240 min
   • GitHub repository structuring
   • Writing professional incident reports
   • Showcasing detection rule repositories
   • Resume translation of lab experience
4. SOC analyst mock interviews240 min
   • Log analysis live troubleshooting drills
   • Behavioral interview preparation
   • Technical Q&A walkthroughs
   • Salary negotiation strategies
5. Certification and next steps240 min
   • Industry certification roadmaps (CompTIA Security+, BTL1, GCIH)
   • Continuing education pathways
   • Joining defensive security communities
   • Career advancement planning

Hands-on project: Complete a simulated 48-hour multi-stage enterprise breach capstone, producing an auditable forensic investigation report, custom SIEM detection rules, and a cloud-hardening repository.