Defend the Fortress:
SOC Analyst Level 1 Training
Course Overview
Defend the Fortress: SOC Analyst Level 1 Training
Defend the Fortress is an intensive 12-week training program meticulously designed to equip aspiring cybersecurity professionals with the essential knowledge and practical skills required to excel as entry-level Security Operations Center (SOC) Analysts. This comprehensive course bridges the gap between theoretical cybersecurity concepts and real-world SOC operations, providing participants with hands-on experience using the same tools and techniques employed by professional security teams in modern enterprises. Through a carefully structured curriculum blending interactive lectures, immersive labs, and realistic attack simulations, students will gain proficiency in monitoring enterprise networks, detecting malicious activity, analyzing security events, and responding to incidents effectively.
🎯 Course Objectives
By the end of this course, students will be able to:
- Monitor and analyze security events using SIEM tools (Splunk, ELK)
- Detect common threats (malware, phishing, DDoS) through log analysis
- Respond to incidents following NIST frameworks
- Use essential security tools (Wireshark, IDS/IPS, EDR solutions)
- Understand attacker TTPs (MITRE ATT&CK) to improve detection
Who Is This Course For?
-
This course is ideal for:
- IT professionals transitioning to cybersecurity
- Help desk/network admins seeking SOC roles
- Cybersecurity beginners with basic networking knowledge
- Military/veterans moving into cyber defense roles
- College students preparing for security careers
Course Outline
Cybersecurity Foundations
This opening week establishes core security principles, including the CIA triad (Confidentiality, Integrity, Availability) and fundamental security controls. Students explore major compliance frameworks like NIST and ISO 27001, understanding their role in organizational security.
Networking for SOC Analysts
Focusing on essential networking knowledge, this week covers TCP/IP protocols, common network architectures, and firewall operations. Participants gain practical skills in traffic analysis through Wireshark, learning to identify normal versus suspicious network patterns - a critical skill for daily SOC operations.
Operating System Security
Students examine security features of Windows and Linux systems, focusing on event logging, process monitoring, and system hardening techniques. The lab session challenges participants to differentiate between legitimate and malicious system processes, building foundational skills for host-based analysis.
SIEM Fundamentals
This week introduces Security Information and Event Management systems, covering Splunk/ELK architecture and basic query writing. Learners practice creating custom dashboards and detection alerts, gaining firsthand experience with the primary tools used in modern SOC environments.
Threat Detection
Participants learn to identify common attack patterns including malware infections, phishing attempts, and brute force attacks. Through log analysis exercises, students develop the analytical skills needed to spot anomalies in system and network logs.
Incident Response
Covering the NIST incident response lifecycle, this week teaches containment, eradication, and recovery strategies. A simulated ransomware attack lab provides practical experience in responding to critical security incidents.
IDS/IPS Analysis
Students explore intrusion detection and prevention systems, learning to create and tune detection rules in Snort/Suricata. The lab focuses on investigating real alert scenarios and determining true positives from false alarms.
Endpoint Security
This week examines Endpoint Detection and Response (EDR) solutions and basic malware analysis techniques. Participants analyze artifacts from infected hosts, practicing the investigative process used in real breach investigations.
Threat Intelligence
Focusing on the MITRE ATT&CK framework, students learn to analyze attacker Tactics, Techniques, and Procedures (TTPs). The lab involves mapping real-world attacks to the ATT&CK matrix, enhancing threat categorization skills.
Threat Hunting
Moving beyond reactive monitoring, this week teaches proactive threat hunting methodologies. Participants develop and test security hypotheses, learning to uncover stealthy threats that evade automated detection.
Cloud Security Monitoring
Expanding into cloud environments, the curriculum covers security logging in AWS/Azure and cloud SIEM integration. Students investigate simulated cloud breaches, understanding the unique challenges of cloud-based security monitoring.
Capstone & Career Prep
The program culminates in a full-scale SOC simulation where students apply all learned skills. Career preparation includes resume workshops and interview coaching, bridging the gap between training and employment. Participants leave with a portfolio of completed security analyses to showcase to potential employers.
Facilitator
Abdulrahman Huzaifa
Cyber Security Analyst
a.huzaifa@fortresspath.com