Course content
5 units · 16 sessions · 64 hoursSOC foundations and toolsWeeks 1–5
Blue team work, SOC roles, incident management in TheHive, threat intelligence in MISP, and SIEM with the Elastic Stack.
Week 1Blue team basics and lab setup
- 1What defenders do: events, alerts and incidentsLab: Build your virtual lab and start TryHackMe's intro rooms.
Week 2Inside a SOC
- 1Tier 1, 2 and 3 roles and a network built to be defendedLab: Sort a batch of alerts by type and urgency.
Week 3Managing incidents
- 1The life of a case: from alert to reportLab: Open, investigate and document a case in TheHive.
Week 4Threat intelligence
- 1Indicators of compromise and how attackers workLab: Import indicators into MISP and match them to your logs.
Week 5SIEM with the Elastic Stack
- 1Central logging with Elasticsearch, Logstash and KibanaLab: Search with KQL and build your first SOC dashboard.
Network analysisWeeks 6–9
Capturing and reading traffic in Wireshark, and how to spot attacks over DNS, the web, email and phishing.
Week 6Capturing network traffic
- 1Packets, TAPs and SPAN ports, and reading traffic in WiresharkLab: Find the suspicious connections in a PCAP file.
Week 7DNS and the attacks that hide in it
- 1DNS tunnelling, fast flux and generated domainsLab: Spot a command and control channel hiding in DNS traffic.
Week 8Web traffic: HTTP and HTTPS
- 1Requests, headers, intrusion attempts and encrypted trafficLab: Catch a malicious download in web logs with Zeek.
Week 9Email and phishing
- 1Email headers, SPF, DKIM and DMARCLab: Take apart a targeted phishing email and its attachment.
Endpoints, logs and filesWeeks 10–13
Windows, Sysmon and Linux logs, normalising and enriching logs, and examining suspicious files safely.
Week 10Windows logging
- 1How attackers move on endpoints, and defence in depthLab: Turn on and audit the Windows logs that matter, plus Sysmon.
Week 11Reading Windows events
- 1Process creation, privilege escalation and registry changesLab: Trace an intrusion step by step in Event Viewer and Sysmon.
Week 12Linux logs and normalising data
- 1/var/log, auditd and making logs from many sources matchLab: Enrich your logs and build visualisations from them.
Week 13Suspicious files
- 1File types, magic bytes and obfuscated code, without running itLab: Examine a malware sample safely and pull out its hashes.
Triage, analysis and detection tuningWeeks 14–15
Prioritising alerts, structured analysis, cutting false positives and the basics of automation with SOAR.
Week 14Alert triage and structured analysis
- 1Alert fatigue, priorities and testing your hypothesesLab: A timed triage challenge on a queue of real-looking alerts.
Week 15Tuning detections and automation
- 1Cutting false positives, writing detection rules, SOAR basicsLab: Tune a noisy rule and automate one triage step.
Containment and graduationWeek 16
Containing infected machines, interview preparation, the graduation CTF and the final project: a full attack investigation and incident report.
Week 16Containment, careers and the final CTF
- 1Containing an intrusion, interview prep and a blue team CTFLab: Isolate an infected machine, then compete in the graduation CTF.