SOC Fundamentals
Learn how a modern Security Operations Center actually works, from the 2 AM alert through triage. Build SIEM data pipelines, map behaviour with MITRE ATT&CK, write and tune Elasticsearch detection rules, author KQL queries for threat hunting, and finish with a full-day end-to-end SOC capstone.
View badge details
About This Course
Learn how a modern Security Operations Center actually works, from the alert that arrives at 2 AM to the triage decisions that keep business running. You will understand the SIEM data pipeline from log collection through correlation rules, use MITRE ATT&CK as your daily reference for naming adversary behavior, write and tune Elasticsearch detection rules against real log data, author KQL queries for threat hunting, work through a L1 triage scenario role-play, and finish with a full-day capstone running the SOC workflow end to end.
Course Curriculum
10 Lessons
The SOC role and the three-tier model
Learn what a modern Security Operations Center actually does, how work flows between L1 triage, L2 investigation, and L3 engineering tiers, and the specific judgment that each tier contributes. By the end you will be able to describe the three tiers with specific examples of what each owns, trace a single alert through the three tiers to see which decisions each makes, and explain why burnout is the structural problem the SOC profession has not yet solved.
SIEM architecture and the data pipeline
Learn how a modern SIEM (Security Information and Event Management) system takes raw log data from dozens of sources and produces the alerts that land in your L1 queue. By the end you will be able to describe the SIEM data pipeline from source agents through parsers, enrichers, and correlation engines, name the specific log source types every Beacon Harbor SOC needs (endpoint, identity, network, cloud control plane), and explain why Microsoft Sentinel and Elasticsearch dominate the current market and when each fits.
MITRE ATT&CK as the SOC's daily vocabulary
Learn MITRE ATT&CK — the standardized vocabulary that modern SOCs use to describe adversary behavior across teams, tools, and incident reports. By the end you will be able to navigate ATT&CK's 14 tactics and 200+ techniques, map a detected alert to one or more ATT&CK techniques, use the ATT&CK Navigator to visualize detection coverage, and tell Priya exactly which Beacon Harbor coverage gaps she should prioritize for the next quarter.
Build detection rules against sample log data - Lab Exercises
Note: This lab pre-provisions an Azure Linux VM at start — allow up to 10 minutes for the environment to become ready before beginning the exercises.
Work with sample Entra sign-in logs on a Linux VM and author detection rules that mimic what a SIEM analytic rule does. You will write jq-based pattern-matching that catches impossible travel and credential-stuffing patterns, tune the rules to reduce false positives, then convert your working logic into a portable Sigma YAML rule that could ship to any SIEM backend. By the end you will have practiced the full detection-engineering loop: baseline → match → tune → portable rule.
KQL fundamentals for threat hunting
Learn KQL (Kusto Query Language), the query language used in Microsoft Sentinel, Microsoft Defender XDR, Azure Monitor, and Azure Data Explorer. By the end you will be able to write KQL queries that filter, project, join, and summarize log data; use the operators that make hunting queries practical (where, project, summarize, join, let, bin); and understand when to use scheduled analytic rules vs ad-hoc hunting queries.
KQL hunting against the public Sentinel demo - Lab Exercises
Practice KQL hunting queries against the Microsoft Learn public Sentinel demo environment — a real Sentinel tenant seeded with representative data. You will answer a sequence of hunting questions (impossible travel candidates, OAuth-consent anomalies, service-principal credential abuse), use summarize, join, let, and extend to shape the data, and tell Priya which of your hunting hits warrant promotion to analytic rules. By the end you will have run the complete hunting-question-to-detection-rule workflow against real data.
Alert triage and playbooks
Learn the structured triage workflow that lets a L1 analyst process 30+ alerts per shift without missing real threats, and understand how SOAR playbooks automate the repetitive parts of each alert's response. By the end you will be able to walk through the standard triage sequence (validate → scope → classify → act → document), author a simple playbook for auto-closing known false positives, and know when to automate vs when to keep a human in the loop.
SOC L1 shift role-play - Lab Exercises
Work a simulated SOC L1 shift. The AI agent plays the role of your SIEM, your SOC manager Priya Navathe, and the users whose accounts you'll be investigating. You will triage 5 alerts across your 90-minute "shift", applying the 5-step workflow (validate → scope → classify → act → document) and ending with a shift-handover brief to the next L1. By the end you will have practiced the full L1 workflow under realistic time pressure and received Priya's feedback on each decision.
Sigma, detection-as-code, and shift handover
Round out the SOC toolkit: Sigma rules let you author detection content once and target multiple SIEMs; detection-as-code applies software engineering discipline (git, PR review, CI/CD) to rule authoring; disciplined shift handover prevents work loss across the SOC rotation. By the end you will be able to read and author a Sigma rule, describe the detection-as-code workflow, and run a shift handover that leaves no in-flight case orphaned.
Full-day SOC workflow capstone - Lab Exercises
Note: This lab pre-provisions an Azure Linux VM at start — allow up to 10 minutes for the environment to become ready before beginning the exercises.
Capstone: run a complete simulated SOC L1 → L2 workflow end to end. Over 5 exercises you will build a workbench with sample log data for a full day's alerts, triage 5 alerts applying the 5-step workflow, author 2 new Sigma detection rules based on patterns you find, write a shift handover note, and compile the metrics brief Priya needs for the SOC monthly review. By the end you will have practiced the entire Course 3 skill chain in one connected workflow.
This course is currently being updated. Check back soon!
This course includes:
- 24/7 AI Instructor Support
- Live Lab Environments
- 3 Hands-on Lessons
- Completion Badge
Earn Your Badge
Complete all lessons to unlock the CYBER-300 SOC Fundamentals achievement badge.
CYBER-300 SOC Fundamentals
Awarded for completing CYBER-300 SOC Fundamentals: understanding SIEM data pipelines, mastering MITRE ATT&CK as a daily reference, authoring Elasticsearch and KQL detections, working through SOC L1 triage scenarios, and completing a full-day SOC workflow capstone.
Skills You'll Earn
Complete all lessons in this course to earn this badge