Course Modules
Practical SOC training organised across six core capability areas. Modules can be selected individually or combined into a tailored programme based on your team's needs.
Training is designed to strengthen the skills analysts use during day-to-day SOC operations, investigations, detection development, incident response and digital forensics.
SOC Foundations
Build a strong understanding of how a SOC operates, how teams are structured, and how work moves through the security operations lifecycle.
- Introduction to SOC Operations
- Building a SOC
- SOC Roles & Responsibilities
- SOC Processes & Workflows
SOC Operations
Strengthen the operational skills analysts need to triage alerts, investigate incidents, document findings and escalate effectively.
- L1 Alert Triage
- L2 Investigation
- Alert Prioritisation
- Incident Ticketing
SIEM & Log Analysis
Develop vendor-neutral SIEM investigation skills focused on logs, querying, analysis and use-case development.
- SIEM Fundamentals
- Log Analysis
- SIEM Querying
- SIEM Use-Case Development
Detection Engineering
Learn how detections are designed, mapped, reviewed and improved to increase useful signal and reduce unnecessary alert noise.
- Detection Engineering
- Detection Rule Development
- MITRE ATT&CK for SOC Analysts
- Detection Tuning
DFIR
Develop foundational digital forensics and incident investigation skills across endpoints, memory and network evidence.
- Digital Forensics Fundamentals
- Windows Forensics
- Memory Forensics
- Network Forensics
Incident Response
Build a structured approach to common incident types, from initial investigation through evidence review, containment and escalation.
- Incident Response Fundamentals
- Phishing Investigation
- Account Compromise Investigation
- Ransomware Investigation
Choose the depth that fits your team
The same curriculum can be delivered at different levels of depth depending on your objectives, available time, and the amount of practical work required.
Training is currently delivered remotely via Microsoft Teams, Zoom, or Webex.
Crash Course
FFocused training on a specific SOC capability. Ideal for targeted knowledge gaps, with short practical exercises..
Extended Crash Course
Deeper instructor-led training combining theory with practical exercises.
Full-Day SOC Workshop
A full remote training day combining multiple concepts, practical investigations and scenario-based exercises, with scheduled breaks and a one-hour lunch break.
Training built around your SOC
Modules can be combined and adapted to reflect your team's current pain points, technology stack, analyst experience and training objectives.