Module 1: Cybersecurity Fundamentals

Week 1

• Introduction to cybersecurity and SOC operations
• Types of cyberattacks and threat actors
• CIA Triad: Confidentiality, Integrity, Availability
• Malware, ransomware, phishing and social engineering
• Security policies, risk management and security controls
• SOC Tier 1, Tier 2 and Tier 3 roles
• Module 2: Networking Fundamentals
• Week 2
• OSI and TCP/IP models
• IP addressing, subnetting and common ports
• DNS, DHCP, HTTP, HTTPS, FTP and SSH
• TCP vs UDP, routing and switching basics
• Firewalls, VPNs, proxies and NAT
• Wireshark packet analysis fundamentals
• Module 3: Windows & Linux Fundamentals
• Weeks 3–4
• Windows users, groups, permissions and services
• Windows Event Viewer and Security logs
• Windows authentication and Active Directory basics
• Linux commands, users, permissions and processes
• Linux authentication and system logs
• PowerShell and Bash basics for security investigations
• Practical: Identify suspicious login activity from system logs

Month 2: SIEM Tools & Security Monitoring

Module 4: Log Management & Analysis

Weeks 5–6

• Log sources: Windows, Linux, firewall, endpoint and network
• Authentication, process and network event analysis
• Normal vs suspicious activity
• Failed login attempts and brute-force detection
• Log correlation and event timelines
• Introduction to Indicators of Compromise (IOCs)
• Module 5: SIEM & Microsoft Sentinel
• Weeks 7–8
• SIEM architecture and security monitoring workflows
• Introduction to Microsoft Sentinel and Microsoft Defender
• Azure portal and Log Analytics workspace fundamentals
• Connect data sources and configure data collection
• Kusto Query Language (KQL) fundamentals
• Search, filter, summarize and correlate security logs
• Analytics rules, incidents, entities and alert investigation
• Workbooks, watchlists and automation rule fundamentals
• Practical: Build a basic detection rule and investigate an incident

Additional exposure: Splunk Enterprise Security concepts and dashboards, depending on lab availability.

Month 3: Threat Detection, EDR & Incident Response

Module 6: Threat Detection & Threat Intelligence

Weeks 9–10

• Threat intelligence feeds and IOC enrichment
• IP addresses, domains, URLs, file hashes and reputation checks
• MITRE ATT&CK framework and adversary tactics
• Phishing email analysis and malicious URL investigation
• Malware behavior and ransomware indicators
• Brute-force, password spraying and account compromise detection
• Threat hunting fundamentals
• Practical: Map alerts to MITRE ATT&CK techniques
• Module 7: EDR & Incident Response
• Weeks 11–12
• Endpoint Detection and Response (EDR) fundamentals
• Microsoft Defender for Endpoint concepts
• Endpoint alerts, process trees and suspicious behavior
• Incident response lifecycle
• Triage, investigation, containment and recovery
• Evidence collection and incident documentation
• Escalation procedures and SOC communication
• Introduction to SOAR and automated playbooks
• Practical: Investigate a simulated malware alert and write an incident report

Month 4: Advanced SOC Skills & Job Preparation

Module 8: Advanced Security Investigations

Weeks 13–14

• Advanced KQL queries and multi-event correlation
• Suspicious PowerShell and command-line analysis
• Identity and access security investigations
• Lateral movement and privilege escalation indicators
• Web and firewall log investigations
• Detection engineering fundamentals
• False positives, alert tuning and detection improvement
• Introduction to cloud security monitoring
• Module 9: SOC Capstone Project & Career Preparation
• Weeks 15–16
• Simulated SOC monitoring and alert triage
• Investigate multiple security incidents from logs
• Build KQL queries and detection rules
• Create an incident investigation timeline
• Prepare incident reports and escalation notes
• SOC analyst interview questions and mock interviews
• Resume preparation and practical assessment
• Final project presentation