SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations

Overview

Section 1 establishes the strategic foundation every SOC analyst needs to operate effectively in modern security operations. You'll start by understanding what SOCs are actually trying to accomplish, how to analyze your organization's threat model, and why building threat-informed defenses matters more than deploying generic security controls. We'll cover the analyst mindset, essential workflows, and how SOC information management tools fit together - from incident management systems and threat intelligence platforms to SIEMs, SOAR tools, and the complete technology stack that powers effective cyber defense.

The section concludes with a comprehensive look at generative AI in security operations. You'll identify practical opportunities for AI integration, understand emerging technologies like MCP and AI agents, and explore specific use cases for SOC workflows. We'll cover how AI can improve documentation, research, and analysis while also examining AI-based threats and defensive considerations. By the end, you'll understand how to position yourself and your SOC for the AI-powered future of cybersecurity.

Full Lab Details

• Threat Intelligence Platforms for SOC Analysts
• Using a SIEM for Log Analysis
• Case Management Systems - Playbooks and Workflow Design
• The AI-Powered SOC - Prompting, Investigating, and Coding with LLMs

Full Topic Details

• Foundations of security operations
• What is a SOC trying to achieve
• How does a SOC achieve their goal?
• Resources needed for a successful SOC
• Cyber Threat Intelligence (CTI) and Building a Threat-Informed Defense
• CTI for SOC Analysts
• Threat intelligence platforms
• Building a Threat-Informed Defense
• SOC Data and Tools
• Evidence Data and Tools (SIEM, XDR, EDR, NDR, etc.)
• Process and Investigation Data and Tools (Case management tools, SOAR, playbooks and use cases)
• Contextual Data and Tools (Threat intelligence platforms, vulnerability data, identity information, asset inventories, etc.)
• Generative AI for the SOC
• Identifying opportunities and best practice for when to use generative AI
• MCP, AI Agents, and A2A
• Generative AI use cases for the SOC
• Improving workflow, documentation, and research with AI
• AI-based threats and dangers
• Moving toward the AI-powered SOC of the future

Overview

Section 2 is introduced with a deep dive into network-based threat hunting, where you'll master the art of catching attackers through traffic analysis. This session begins with building a solid foundation in network architecture and security monitoring, teaching you how routers, switches, and firewalls all can be used for maximum visibility and monitoring traffic flow patterns. You'll then master the critical tools of the trade from flow logs and metadata to full packet capture, learning how to use each format and how to extract maximum intelligence from network data.

The core part of this section shows how to dissect the protocols attackers love to abuse. You'll become a DNS expert, understanding normal usage patterns and critical record types before diving into DNS-based attacks like tunneling and domain generation algorithms. We'll crack open HTTP traffic analysis, from method and header inspection to file extraction, then explore cutting-edge HTTP/2 and HTTP/3 dissection techniques. You'll learn to detect suspicious encrypted traffic even without decryption using TLS fingerprinting, certificate inspection, and understanding how TLS 1.3 and ECH are changing the game for attackers and defenders. Finally, we'll explore the protocols attackers use post-exploitation, including remote administration tools that often hide in plain sight. By day's end, you'll think like a network hunting expert, capable of spotting the subtle signs of compromise that others miss.

Full Lab Details

• Monitoring DNS Requests, Traffic, and Analysis
• Analyzing Malicious DNS
• Wireshark Workflow and HTTP Analysis
• Decoding and Analyzing HTTP/2 and HTTP/3 Traffic
• Analyzing TLS Traffic without Decryption

Full Topic Details

• Network Architecture and Security Monitoring
• Routers, Switches, and Firewalls for Visibility
• Security Zones and Traffic Flow
• Traffic Capture Formats and Analysis Tools
• Options for Traffic Capture
• Flow Logs, Metadata, and Full Packet Capture
• Deep Dive on DNS
• Understanding Normal Usage Patterns
• Important Record Types for Security Monitoring
• DNS over HTTPS (DoH) Implications for Security Teams
• DNS analysis and attacks
• Enriching DNS Logs for Threat Detection
• DNS-Based Attacker Techniques (DNS Tunneling, Domain Generation Algorithms and More)
• HTTP Methods and Header Analysis
• HTTP Methods and Key Header Data for Monitoring
• File Extraction from Captured HTTP Transactions
• HTTP-Based Threats, Attacks, and Analysis
• Automated and Manual HTTP Analysis Methods
• Investigating Suspicious HTTP Transactions
• HTTP/2 & HTTP/3
• How HTTP/2 Works, and How to Dissect It
• How HTTP/3 Works, and How to Dissect It
• Detection Suspicious Traffic with and without Decryption
• TLS Interception and Decryption Methods
• HTTPS and Certificate inspection
• TLS Fingerprinting
• TLS1.3 and ECH Implications for Security Monitoring
• Common Protocols for Post-Exploitation
• Remote Administration Protocols of Interest
• Catching Lateral Movement

Overview

The first half of section 3 focuses on transforming you into a log analysis expert, teaching you to extract meaningful threat intelligence from the massive volumes of data flowing through modern security environments. You'll master SIEM usage including precise search query crafting and visualization creation that turns raw data into actionable insights. We'll cover Windows and Linux logging mechanisms, critical event types that reveal attacker activity, and comprehensive cloud logging across AWS CloudTrail, Azure Activity Logs, Entra ID, and Microsoft 365's Unified Audit Log.

The second half of the section focuses on malware analysis fundamentals every SOC analyst needs. You'll learn safe file handling procedures, static analysis techniques, IOC extraction, and how to leverage automated sandboxes effectively. We'll dissect commonly weaponized file types and show you how to extract intelligence that strengthens your organization's defenses. By the end, you'll confidently navigate complex log data and suspicious files to uncover the threats others miss.

Full Lab Details

• Building SIEM Visualizations and Dashboards
• Threat Hunting with a SIEM
• Suspicious File Triage, Static Analysis, and Malware Sandboxes
• Reverse Engineering Common Malware File Types

Full Topic Details

• Deep Dive on SIEM for Threat Detection
• Key SIEM Deployment Considerations
• Understanding and Crafting Effective SIEM Search Queries
• SIEM Visualizations and Dashboard Creation
• How Windows and Linux Logging Works
• Audit Logs and Channels of Interest
• Key Log Events for Threat Detection and How to Interpret Them
• Cloud Logging
• AWS and CloudTrail
• Azure Activity Logs
• Entra ID Audit Logs
• Microsoft 365 and the Unified Audit Log
• Key Event Types for Threat Detection
• Malware Analysis Fundamentals
• Handling and Moving Suspicious Files
• Static Analysis and File Identification
• Identifying Malicious Files and Basic IOC Extraction
• How to use Automated Malware Sandboxes
• Commonly Weaponized File Types, and How to Dissect Them

Overview

Section 4 focuses on two critical SOC skills: mastering phishing investigations and developing structured analysis techniques that separate expert analysts from beginners. The first half covers comprehensive phishing defense, from blocking suspicious URLs and attachments to identifying spoofed emails and stopping sophisticated BEC scams. You'll then investigate common phishing techniques, learning how attackers manipulate users into clicking, where they host malicious content, how they evade automated scanners, and the latest MFA bypass methods that are fooling even security-aware users.

The second half transforms your analysis approach through structured techniques and operational security. You'll master alert triage and prioritization, learning the essential information needed for accurate decisions and designing workflows that handle high-volume environments effectively. We'll cover operational security for SOC analysts—investigating threats without alerting attackers to your activities, avoiding common OPSEC mistakes, and anonymizing investigations. Finally, you'll learn structured analytical techniques that help you avoid cognitive biases, understand which evidence truly matters, and develop workflows that consistently produce high-quality analysis under pressure.

Full Lab Details

• Analyzing Phishing Email Headers and Identifying Spoofed Email
• Dissecting Modern Malicious Email Attachments
• Applied Alert Triage & Prioritization
• Applying Structured Analysis Techniques for High Quality Investigation

Full Topic Details

• Phishing Prevention
• Blocking Suspicious URLs and Attachments
• Identifying Spoofed Email
• Stopping Social Engineering and Business Email Compromise (BEC) Scams
• How To Investigate Common Phishing Techniques
• How Attackers Get Users to Click
• Phishing Hosting
• Hiding Attackers Hide Phishing Links from Automated Scanners
• MFA Bypass Techniques and How to Spot Them
• Business Email Compromise (BEC) Scam Types
• Alert Triage and Prioritization
• The Information Required for Accurate Alert Triage
• Goals and Mindset for Triage
• Alert and Triage Workflow Design
• Structured Analysis Techniques
• Avoiding Common Analysis Errors
• Knowing Which Evidence Data Does and Doesn’t Matter
• Workflow for High-Quality Analysis
• Operational Security (OPSEC) for SOC Analysts
• Investigating Attack Attempts without Tipping Your Hand to Attackers
• Common OPSEC Mistakes, and how to Avoid Them
• Anonymizing Your Investigations

Overview

Section 5 elevates you from reactive analyst to proactive detection engineer and sets you up for long-term career success. You'll start with detection engineering fundamentals, understanding why high-fidelity detections are so challenging to create and mastering different signature types. We'll dive into practical tools like YARA-X for malware detection and Sigma for log-based rules, giving you hands-on experience building detections that actually work in production environments.

The section then tackles the critical challenge of alert tuning and false positive reduction. You'll learn how to determine appropriate alert volumes, understand why detections perform poorly in practice, and implement proven strategies to reduce noise while maintaining security coverage. We'll explore automation and orchestration, showing you when automation helps versus when it creates new problems, plus practical use cases that genuinely improve SOC efficiency. Finally, you'll develop skills for investigation quality assessment, learn structured review techniques, and get essential guidance on avoiding burnout and advancing your cybersecurity career sustainably.

Full Lab Details

• File-Based Detection with YARA-X
• Log-Based Detection with Sigma
• Alert Tuning and False Positive Reduction
• Integrating generative AI into SOC Automation
• Collecting and Documenting Incident Information for Effective Incident Reporting

Full Topic Details

• Detection Engineering
• Why Is It So Difficult To Write a High-Fidelity Detection?
• Signature Types
• YARA-X for Malware File Detection
• Sigma for Log-Based Detection
• Alert Tuning and False Positive Reduction
• How Many Alerts Should You Create?
• Why Alerts Perform Poorly
• Strategies to Reduce Alert Volume
• Automation and Orchestration
• When and When Not To Use Automation
• Automation Use Cases
• Investigation Quality
• What Does a High-Quality Investigation Look Like?
• How Can We Measure Ourselves and Our Team’s Work?
• Structured Review Techniques
• How to Avoid Burnout For SOC Analysts
• The Factors that Increase Engagement at Work
• Good and Bad Stress on the Job
• Skill and Career Development Advice

Overview

The course culminates in an intense, team-based capture the flag competition that puts everything you've learned to the test. Working with real network data and logs from a simulated environment under active attack, you'll race against other teams to detect and identify sophisticated threats across multiple challenge categories. This isn't just review—it's a full day of high-stakes problem solving that proves you can apply advanced threat hunting and analysis techniques under pressure, just like you'll face in real SOC operations.