I. Overview:

The Certified SOC Analyst (CSA) program is the first step to joining a security operations center (SOC). It is engineered for current and aspiring Tier I and Tier II SOC analysts to achieve proficiency in performing entry-level and intermediate-level operations.
CSA is a training and credentialing program that helps the candidate acquire trending and in-demand technical skills through instruction by some of the most experienced trainers in the industry. The program focuses on creating new career opportunities through extensive, meticulous knowledge with enhanced level capabilities for dynamically contributing to a SOC team. Being an intense 3-day program, it thoroughly covers the fundamentals of SOC operations, before relaying the knowledge of log management and correlation, SIEM deployment, advanced incident detection, and incident response. Additionally, the candidate will learn to manage various SOC processes and collaborate with CSIRT at the time of need.

II. Duration: 3 days (24 hours)

III. Objectives:

What Skills You'll Learn

• Acquire a comprehensive knowledge of SOC processes, procedures, technologies, and workflows.
• Develop a foundational and advanced understanding of security threats, attacks, vulnerabilities, attacker behavior, and the cyber kill chain.
• Learn to identify attacker tools, tactics, and procedures to recognize indicators of compromise (IoCs) for both active and future investigations.
• Gain the ability to monitor and analyze logs and alerts from various technologies across multiple platforms, including IDS/IPS, endpoint protection, servers, and workstations.
• Understand the centralized log management (CLM) process and its significance in security operations.
• Acquire skills in collecting, monitoring, and analyzing security events and logs.
• Attain extensive knowledge and hands-on experience in security information and event management (SIEM).
• Learn how to administer SIEM solutions such as Splunk, AlienVault, OSSIM, and the ELK Stack.
• Understand the architecture, implementation, and fine-tuning of SIEM solutions for optimal performance.
• Gain practical experience in the SIEM use case development process.
• Develop threat detection cases (correlation rules) and create comprehensive reports.
• Learn about widely used SIEM use cases across different deployments.
• Plan, organize, and execute threat monitoring and analysis within an enterprise environment.
• Acquire skills to monitor emerging threat patterns and perform security threat analysis.
• Gain hands-on experience in the alert triaging process for effective threat management.
• Learn how to escalate incidents to the appropriate teams for further investigation and remediation.
• Use service desk ticketing systems for efficient incident tracking and resolution.
• Develop the ability to prepare detailed briefings and reports outlining analysis methodologies and results.
• Learn how to integrate threat intelligence into SIEM systems for enhanced incident detection and response.
• Understand how to leverage diverse and continually evolving sources of threat intelligence.
• Gain knowledge of the incident response process and best practices for managing security incidents.
• Develop a solid understanding of SOC and incident response team (IRT) collaboration for improved incident management and response.
• Assist in responding to and investigating security incidents using forensic analysis techniques.
• Gain specialized knowledge in cloud-based threat detection and how to adapt techniques for cloud environments.
• Engage in proactive threat detection by participating in threat-hunting exercises.
• Develop skills in creating SIEM dashboards, generating SOC reports, and building effective correlation rules for advanced threat detection.
• Acquire hands-on experience in malware analysis techniques.
• Explore how AI/ML technologies can be leveraged to improve threat detection and response in SOC operations.

What AI Skills You'll Learn

• AI-driven capabilities are seamlessly embedded within SIEM's architecture, automating processes like threat detection, correlation, and prioritization without requiring separate configurations.
• Improve traditional SOC operations with AI.
• Enhance traditional SIEM systems with AI-enabled features.
• Leverage AI-powered tools' natural language inputs to create detection rules.
• Leverage AI-enabled tools for enhanced behavioral analytics.
• Enhance the identification, categorization, and prioritization of security alerts with AI.
• Integrate Splunk AI and Elasticsearch AI with SIEM.
• Use AI-driven platforms like Copilot, ChatGPT, PowerShell AI module, etc., to generate PowerShell scripts for threat hunting.

IV. Intended Audience:

• SOC Analysts (Tier I and Tier II)
• Network and Security Administrators, Network and Security Engineers, Network Defense Analyst, Network Defense Technicians, Network Security Specialist, Network Security Operator, and any security professional handling network security operations
• Cybersecurity Analyst
• Entry-level cybersecurity professionals
• Anyone who wants to become a SOC Analyst.

V. Course outlines:

1. Module 01: Security Operations and Management

Learn how a SOC enhances an organization's security management to maintain a strong security posture, focusing on the critical roles of people, technology, and processes in its operations.

Key topics covered: SOC, SOC Capabilities, SOC Operations, SOC Workflow, Components of SOC, SOC Models, SOC Maturity Models, SOC Generations, SOC KPIs and Metrics, SOC Challenges

2. Module 02: Understanding Cyber Threats, IoCs, and Attack Methodology

Learn various cyberattacks, their IoCs, and the attack tactics, techniques, and procedures (TTPs) cybercriminals use.

Hands-on labs:

• Perform SQL injection attack, Cross-Site Scripting (XSS) attack, network scanning attack, DoS attack, and brute force attack to understand their TTPs and IoCs.
• Detect and analyze IoCs using Wireshark.

Key topics covered: Cyber Threats, TTPs, Reconnaissance Attacks, Man-in-the-Middle Attacks, Password Attack Techniques, Malware Attacks, Advanced Persistent Threat Lifecycle, Host-Based DoS Attacks, Ransomware Attacks, SQL Injection Attacks, XSS Attacks, Cross-Site Request Forgery (CSRF) Attack, Session Attacks, Social Engineering Attacks, Email Attacks, Insider Attack, IoCs, Attacker's Hacking Methodology, MITRE D3FEND Framework, Diamond Model of Intrusion Analysis

3. Module 03: Log Management

Learn log management in SIEM, including how logs are generated, stored, centrally collected, normalized, and correlated across systems.

Hands-on labs:

• Configure, monitor, and analyze various logs.
• Collect logs from different devices into a centralized location using Splunk.

Key topics covered: Incident, Event, Log, Log Sources, Log Format, Local Logging, Windows Event Log, Linux Logs, Mac Logs, Firewall Logs, iptables, Router Logs, IIS Logs, Apache Logs, Database Logs, Centralized Logging, Log Collection, Log Transmission, Log Storage, AI-Powered Script for Log Storage, Log Normalization, Log Parsing, Log Correlation, Log Analysis, Alerting and Reporting

4. Module 04: Incident Detection and Triage

Learn SIEM fundamentals, including its capabilities, deployment strategies, use case development, and how it helps SOC analysts detect anomalies, triage alerts, and report incidents.

Hands-on labs:

• Develop Splunk use cases to detect and generate alerts for brute-force attempts, ransomware attacks, SQL injection attempts, XSS attempts, Broken Access Control attempts, application crashes using Remote Code Execution, scanning attempts, monitoring insecure ports and services, HTTP flood/denial of service (DoS) attacks, monitoring Windows audit log tampering, and malicious PowerShell script execution.
• Enhance alert triage using the SIGMA rules for Splunk queries.
• Create dashboards in Splunk.
• Create ELK use cases for monitoring trusted binaries connecting to the internet, credential dumping using Mimikatz, and monitoring malware activity in the system.
• Create dashboards in ELK.
• Detect brute-force attack patterns using correlation rules in ManageEngine Log 360.

Key topics covered: SIEM, SIEM Architecture and Its Components, AI-Enabled SIEM, Types of SIEM Solutions, SIEM Deployment, SIEM Use Cases, SIEM Deployment Architecture, SIEM Use Case Lifecycle, Application-Level Incident Detection SIEM Use Cases, Insider Incident Detection SIEM Use Cases, Examples of Network Level Incident Detection SIEM Use Cases, Examples of Compliance Use Cases, SIEM Rules Generation with AI, Alert Triage, Splunk AI, Elasticsearch AI, Alert Triage with AI, Dashboards in SOC, SOC Reports

5. Module 05: Proactive Threat Detection

Learn the importance of threat intelligence and threat hunting for SOC analysts, and how their integration with SIEM helps reduce false positives and enables faster, more accurate alert triage.

Hands-on labs:

• Integrate IoCs into the ELK Stack.
• Integrate OTX threat data into OSSIM.
• Detect incidents in Windows Server using YARA.
• Conduct threat hunting using Windows PowerShell scripts, Hunt Manager in Velociraptor, Log360 UEBA, and Sophos Central.

Key topics covered: Cyber Threat Intelligence (CTI), Threat Intelligence Lifecycle, Types of Threat Intelligence, Threat Intelligence Strategy, Threat Intelligence Sources, Threat Intelligence Platform (TIP), Threat Intelligence-Driven SOC, Threat Intelligence Use Cases for Enhanced Incident Response, Enhanced Threat Detection with AI, Threat Hunting, Threat Hunting Process, Threat Hunting Frameworks, Threat Hunting with PowerShell Script, PowerShell AI Module, Threat Hunting with AI, Threat Hunting with YARA, Threat Hunting Tools

6. Module 06: Incident Response

Learn the stages of incident response and how the IRT collaborates with SOC to handle and respond to escalated incidents.

Hands-on labs:

• Generate tickets for incidents.
• Contain data loss incidents.
• Eradicate SQL injection and XSS incidents.
• Perform recovery from data loss incidents.
• Create incident reports using OSSIM.
• Perform automated threat detection and response using Wazuh.
• Detect threats using Sophos Central XDR.
• Integrate Sophos Central XDR with Splunk.

Key topics covered: Incident Response (IR), IRT, SOC and IRT Collaboration, IR Process, Ticketing System, Incident Triage, Notification, Containment, Eradication, Recovery, Network Security Incident Response, Application Security Incident Response, Email Security Incident Response, Insider Threats and Incident Response, Malware Threats and Incident Response, SOC Playbook, Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), SOAR, SOAR Playbook

7. Module 07: Forensic Investigation and Malware Analysis

Learn the importance of forensic investigation and malware analysis in SOC operations to understand attack methods, identify IoCs, and enhance future defenses.

Hands-on labs:

• Perform forensic investigation of application security incidents: SQL injection attacks.
• Perform forensic investigation of a compromised system incident using Velociraptor.
• Analyze RAM for suspicious activities using Redline.
• Perform static analysis on a suspicious file using PeStudio.
• Examine a suspicious file using VirusTotal.
• Perform dynamic malware analysis in Windows using Process Hacker.

Key topics covered: Forensics Investigation, Forensics Investigation Methodology, Forensics Investigation Process, Forensics Investigation of Network Security Incidents, Forensics Investigation of Application Security Incidents, Forensics Investigation of Email Security Incidents, Forensics Investigation of Insider Incidents, Malware Analysis, Types of Malware Analysis, Malware Analysis Tools, Static Malware Analysis, Dynamic Malware Analysis

8. Module 08: SOC for Cloud Environments

Learn the SOC processes in cloud environments, covering monitoring, incident detection, automated response, and security in AWS, Azure, and GCP using cloud-native tools.

Hands-on Labs:

• Implement Microsoft Sentinel in Azure.

Key topics covered: Cloud SOC, Azure SOC Architecture, Microsoft Sentinel, AWS SOC Architecture, AWS Security Hub, Centralized Logging with OpenSearch, Google Cloud Platform (GCP) Security Operation Center, Security Command Center, Chronicle