SOC Analyst and DFIR Course in Hyderabad

Outcome: Explain how attacks work and how networks and systems are defended, in the terms every security team uses.

Topics

• Threats, vulnerabilities, attacks and controls; confidentiality, integrity and availability
• Networking for analysts: TCP/IP, DNS, DHCP, HTTP, SMTP and VPN
• Network defense: firewalls, IDS/IPS, proxies, segmentation and what each one logs
• Windows and Linux essentials and hardening
• Identity and access management, cryptography and PKI basics
• Wireless, cloud and IoT security basics

Hands-on labs

• Capture and read traffic in Wireshark
• Harden a Windows and a Linux machine against a checklist

Deliverable

Network defense notes and a hardening checklist

Job skills covered

• Networking
• Network security
• Windows and Linux
• CCT core concepts

Outcome: Work inside a SOC and read the logs it depends on: know which source answers which question.

Topics

• L1, L2 and L3 roles, shifts, ticketing, SLAs, escalation and shift handover
• Frameworks: Cyber Kill Chain, MITRE ATT&CK, IOCs vs IOAs and the Pyramid of Pain
• Windows Security events, PowerShell logging and Sysmon
• Active Directory and Kerberos events; Linux authentication, syslog and auditd
• Firewall, proxy, DNS and web server logs; Entra ID sign-in and AWS CloudTrail logs (introduction)
• Parsing, normalization, time zones and ingestion health

Hands-on labs

• Triage a queue of sample alerts and write ticket notes
• Trace one attack across Windows, Sysmon, firewall and DNS logs

Deliverable

Ticket notes, a shift handover and a log-source reference sheet

Job skills covered

• SOC operations
• Log analysis
• MITRE ATT&CK
• CSA core concepts

Outcome: Investigate alerts in Splunk, build searches, dashboards and alerts, and read the same investigation in Sentinel's KQL.

Topics

• Splunk search language (SPL): searching, fields, stats, lookups and knowledge objects
• Dashboards, reports and scheduled alerts
• Investigating authentication, endpoint and network events
• Correlation searches and use cases
• Microsoft Sentinel and KQL: the same investigation in Microsoft's SIEM (orientation and trainer demonstration)

Hands-on labs

• Investigate a brute-force-to-compromise case in Splunk
• Build a dashboard and a scheduled alert

Deliverable

Splunk investigation notes

Job skills covered

• SIEM
• Splunk
• Microsoft Sentinel and KQL (orientation)

Outcome: Monitor endpoints with Wazuh and Sysmon, investigate an endpoint alert the way EDR analysts do, and enrich it with threat intelligence.

Topics

• Wazuh manager, agents, decoders and rules; file integrity monitoring and vulnerability detection
• EDR concepts: process trees, isolation and response, as in tools such as Microsoft Defender and CrowdStrike
• Active response and alert tuning
• Threat intelligence: feeds, reputation services, MISP concepts and enrichment

Hands-on labs

• Deploy agents, generate activity, investigate the alerts and tune a noisy rule
• Enrich indicators from an alert

Deliverable

Endpoint investigation and tuning notes

Job skills covered

• Wazuh
• EDR investigation
• Threat intelligence

Outcome: Work the common L1 alert types with playbooks, write detections mapped to ATT&CK, and hunt for what the detections miss.

Topics

• Triage playbooks: phishing email analysis (headers, SPF, DKIM, DMARC, links and attachments), brute force and password spraying, malware and ransomware alerts, suspicious PowerShell and account compromise
• Sigma rules mapped to MITRE ATT&CK
• Baselines and false-positive reduction
• Hypothesis-driven threat hunting on replayed network and Active Directory attacks
• SOAR and automation concepts

Hands-on labs

• Analyze real-world-style phishing emails
• Write and test Sigma detections
• Run a hypothesis-driven hunt

Deliverable

Detection rules and a hunt report

Job skills covered

• Phishing investigation
• Detection engineering
• Threat hunting
• CSA core concepts

Outcome: Handle an incident from detection to recovery, and communicate it clearly to management and to authorities where required.

Topics

• The incident handling and response process: preparation, detection and analysis, containment, eradication, recovery and lessons learned
• Playbooks for malware, email, web application, network, insider and cloud incidents
• First response, evidence preservation and escalation
• CERT-In six-hour reporting and data breach duties under India's DPDP Act
• Incident communication and the incident report

Hands-on labs

• Run a tabletop exercise
• Contain and eradicate a simulated malware incident

Deliverable

Incident handling report

Job skills covered

• Incident response
• NIST incident response lifecycle
• ECIH core concepts

Outcome: Prove what happened: acquire and analyze disk, memory, network and email evidence, examine suspicious files, and build a defensible timeline.

Topics

• The forensic investigation process, chain of custody and order of volatility
• Disk acquisition and analysis with Autopsy; Windows file systems and artifacts
• Memory forensics with Volatility
• Network and email forensics
• Linux forensics basics
• Malware analysis basics: static and dynamic analysis in a sandbox, and extracting indicators of compromise
• Anti-forensics awareness, timelines and the forensic report

Hands-on labs

• Investigate a disk image and a memory image from a simulated breach
• Analyze a suspicious file in a sandbox

Deliverable

DFIR investigation report

Job skills covered

• Digital forensics
• Malware analysis
• Root cause analysis
• CHFI core concepts

Outcome: Use an AI assistant to work faster on alerts and notes, without letting it make the decision.

Topics

• Summarizing alerts, explaining log events and drafting incident notes with an LLM assistant
• Drafting search queries and Sigma rules with AI, then testing them against real events
• Limits: hallucinations, privacy of log data and a human decision on every escalation
• Watching AI applications for prompt injection and misuse

Hands-on labs

• Draft and verify a detection with AI help

Deliverable

Verified AI-assisted detection

Job skills covered

• Responsible AI use in the SOC

Outcome: Handle a live, timed multi-alert shift, from first alert to forensic findings, escalation and handover.

Topics

• A timed multi-alert simulation with written investigations
• CTF challenges on detection, investigation and forensics
• An incident case with evidence, a timeline, a shift handover and an escalation
• Technical oral exam on your investigation

Hands-on labs

• Timed simulation

Deliverable

SOC monitoring and detection report, and DFIR report

Job skills covered

• End-to-end SOC and DFIR investigation