SOC Specialist Training Course

Domain 1 : SOC Operations and Architecture

• Advance SOC Operations
• Building a successful SOC
• SOC Services: Security Monitoring, Incident Response, Security Analysis, Threat Hunting, Vulnerability Management, Log Management, Malware Analysis, etc.
• SOC Maturity Models, SOC-CMM
• SIEM and Automation
• SOAR
• EDR vs XDR
• MDR & MSSP

Domain 2 : Incident Responder & Forensics Specialists

• Incident Response Process Overview
• Digital Forensics in Incident Response
• The 6 A’s of Forensics Process
• Anti – Forensics Techniques
• Evidence Destruction
• Volatile vs Non-Volatile Data
• Live Acquisition – KAPE
• Network Forensics [Practical]
  • Network Traffic Analysis
    • Post-Mortem Analysis
    • Real-Time Analysis
  • Tools: Wireshark, Network Miner, TCPDump, etc.
  • Introduction to Wireshark
  • PCAP Analysis – 1
  • Malware Traffic Analysis – 1
  • Malware Traffic Analysis – 2
• System Forensics
  • Disk Based Forensics [Practical]
    • Concept of Disk Imaging – FTK Imager
    • Disk Analysis with Autopsy
  • Memory Based Forensics [Practical]
    • Memory Acquisition – Ram Dump
    • Introduction to Volatility
    • Memory Analysis with Volatility
    • Identifying Malicious Processes with Volatility

Domain 3 : Malware Analysis

• Introduction to Malware Analysis
  • Why it is important
• What are Malwares?
• Types of Malwares
• Types of Malware Analysis
• Concept of Sandboxing
• Configuring Malware Lab
  • Installation, Settings, Snapshots
• Static Analysis [Practical]
  • PE Analysis
  • Strings
  • Hashing
  • Local and Online Scanning
  • YARA and yarGen
• Dynamic Analysis
  • Introduction to SysInternals
  • Process Monitoring
  • Autoruns
  • Port Monitoring
  • Anti-Sandboxing Techniques

Domain 4 : Threat Hunting

• Introduction to Threat Hunting
• Threat Hunting vs Threat Detection
• Incident Response & Threat Hunting Relationship
• Types of Hunts
• Threat Hunting Hypothesis
• Threat Hunting Model
• Diamond Model of Intrusion Analysis
• LOTL & GTFO Bins based Techniques
• Malware Campaigns & APTs
• MITRE ATT&CK Framework [Practical]
  • Pre and Post Compromise Detection with Mitre ATT&CK
  • Hunting Hypothesis and Methodology
• Network Traffic Hunting [Practical]
  • Section Introduction
  • HTTP and HTTPS traffic suspects
  • Network Hunting and Forensics
  • Wireshark, Network Miner
• Endpoint Hunting [Practical]
  • Introduction
  • Windows Processes
    • Smss.exe
    • Winlogon.exe
    • Wininit.exe
    • Services.exe
    • Lsass.exe
    • Svchost.exe
    • Taskhost.exe
    • Explorer.exe
• Endpoint Baselines

Domain 5 : SIEM – Nervous System of SOC

• Using IBM QRadar [Practical]
  • Introduction to QRadar
  • QRadar SIEM Component Architecture and Data Flow
  • Using QRadar SIEM User Interface
  • Working with Logs
  • Working with Events of an Offense
  • Investigating Events & Flows
  • Developing Custom Rules
  • Creating Reports

• SOC Analysts (L1, L2 or L3)
• SOC Administrators
• Security Consultants
• Senior SOC Consultant
• Incident Responder L1, L2
• Cyber Security Analysts
• Information Security Researcher
• Intermediate-level Information Security role
• Anyone Who wants to become SOC Specialist or Expert

Good Understanding and Working Knowledge of:

• InfosecTrain SOC Analyst L1 Training or Exam Clearance
• Advanced Operating System Concepts & Troubleshooting is recommended
• In-depth Knowledge of Windows and Linux Operating System
• Deep Knowledge of Information Security
• Intermediate or Expert Knowledge for SOC Operations Centre
• Working on L1 / L2 Role
• Minimum 2 years of experience in SOC

There is no particular exam for this course, and its curriculum is meant to help participants pass a variety of exams to become SOC Specialist.

This SOC Specialist training course will allow you to:

• Understand the Security Operation Center (SOC) team operations
• Understand operations and architecture of SOC
• Learn in-depth the concept of vulnerability management and endpoint analysis, VAPT
• Understand the advanced concepts of SIEM technology like IBM QRadar
• Understand essential concepts of threat hunting