[NP-SOCE-SAS] Security Operations Centre (SOC) Essentials (Synchronous & Asynchronous e-learning)

About Course

Course Objectives

The Security Operations Centre (SOC) Analysis module prepares participant to work effectively in a Security Operations Center (SOC) environment. The course covers the installation and configuration of Windows Server and domain services, as well as firewall and Intrusion detection systems (IDS) / intrusion prevention systems (IPS) systems. Participant will learn to use Security Information and Event Management (SIEM) systems like ELK (Elastic Logstash Kibana) and Splunk for monitoring and alerting. The module also includes training on log analysis, using tools like System Monitor (Sysmon) and YARA (an open-source tool designed to help malware researchers to identify and classify malware samples) for event detection and threat hunting. By the end of this module, participant will have a comprehensive understanding of SOC operations and will be able to configure and manage security infrastructure, analyze events, and respond to incidents efficiently.

Course Description

By the end of this course, participant will be able to:     
  
1. Acquire comprehensive knowledge on setting up and managing a Windows Domain using System Monitor (Sysmon) for event logging and monitoring  
2. Learn to install and configure Windows Server, manage Active Directory, and implement domain protocols  
3. Learn to install and configure firewalls using Sense, manage network traffic with Network address translation (NAT), and monitor real-time events with Intrusion detection systems (IDS) / intrusion prevention systems (IPS) systems like Snort  
4. Master the use of Security Information and Event Management (SIEM) systems on ELK (Elastic Logstash Kibana) and Splunk to monitor events, create and optimize custom queries, and develop alert settings, enabling them to conduct detailed and effective data analyses and threat detection.  
5. Explore advanced techniques in cybersecurity threat hunting, including log analysis, using Sysmon for event detection, and employing tools like YARA (an open-source tool designed to help malware researchers to identify and classify malware samples) for signature writing.   tall and configure Windows Server, manage Active Directory, and implement domain protocols 3. Learn to install and configure firewalls using Sense, manage network traffic with Network address translation (NAT), and monitor real-time events with Intrusion detection systems (IDS) / intrusion prevention systems (IPS) systems like Snort 4. Master the use of Security Information and Event Management (SIEM) systems on ELK (Elastic Logstash Kibana) and Splunk to monitor events, create and optimize custom queries, and develop alert settings, enabling them to conduct detailed and effective data analyses and threat detection. 5. Explore advanced techniques in cybersecurity threat hunting, including log analysis, using Sysmon for event detection, and employing tools like YARA (an open-source tool designed to help malware researchers to identify and classify malware samples) for signature writing.

Course Structure

TPG course reference No.

TGS-2025053100