What you'll learn
- The SOC workflow
- IR lifecycle (NIST SP 800-61r3)
- Detection engineering
- Ransomware readiness
Lessons
1The SOC workflow
Collect → normalize → detect → triage → investigate → respond → improve. Tiers: L1 triage, L2 investigation, L3 hunting and engineering. Measure MTTD and MTTR, false-positive rate and coverage against ATT&CK.
2IR lifecycle (NIST SP 800-61r3)
r3 (2025) aligns IR with CSF 2.0: prepare (Govern/Identify/Protect), detect & analyze, respond (contain, eradicate, recover), and lessons learned feeding back into improvement.
- Contain before you eradicate; preserve evidence first.
- Keep a timeline with UTC timestamps.
- Out-of-band comms if email may be compromised.
3Detection engineering
Write detections as code (Sigma, KQL, SPL), test them against sample logs, map to ATT&CK, and tune with allow-lists. Good detections describe behavior (e.g. new admin account created outside change window) rather than a single file hash.
// KQL: new member added to a privileged group SecurityEvent | where EventID in (4728, 4732, 4756) | project TimeGenerated, Account, TargetUserName, MemberName
4Ransomware readiness
Immutable, offline backups tested by restore drills; EDR in block mode; MFA on remote access; ESXi and backup servers isolated; a decision tree for containment approved in advance by leadership.
Hands-on lab: Triage alerts in your Wazuh or Sentinel lab
- In your own SIEM sandbox, generate 5 failed logins followed by a success on a test VM.
- Find the events (Windows 4625/4624 or Linux auth.log).
- Write a rule: ≥5 failures then success from one source within 10 minutes.
- Trigger it again and confirm the alert fires.
- Document the alert: what, so-what, next steps (a triage note).
Outcome: An end-to-end tested detection with a runbook entry.
Practice questions
Which comes first after confirming an incident?
Answer: Containment. Stop the spread, preserve evidence, then eradicate.
Windows Event ID 4625 means…
Answer: Failed logon. 4625 = account failed to log on.
Sigma is…
Answer: A generic detection rule format. Vendor-neutral detection rules.
The full graded assessment (5 questions, pass mark 70%) is in the platform.
Key terms
- SIEM
- Security Information and Event Management: collects, correlates and alerts on logs.
- SOAR
- Security Orchestration, Automation and Response: playbooks that automate response steps.
- EDR
- Endpoint Detection and Response: endpoint telemetry, detection and response actions.
- XDR
- Extended detection and response across endpoint, identity, email, cloud and network.
- MTTD
- Mean Time to Detect.
- MTTR
- Mean Time to Respond/Recover.
- True positive
- An alert that correctly identifies malicious activity.
- False positive
- An alert that fires on benign activity.
- Playbook
- Step-by-step response procedure for a specific incident type.
- Containment
- Limiting an incident's spread, e.g. isolating hosts or disabling accounts.
See the full cyber security glossary →
Official references
Related courses
Threat Intelligence & MITRE ATT&CK
Intelligence lifecycle, ATT&CK mapping, IOCs vs TTPs and turning news into defensive action.
Endpoint Security & Malware Analysis
Hardening, EDR, forensics basics and safe static triage of suspicious files.
Digital Forensics
Evidence handling, Windows and Linux artifacts, memory forensics and building timelines.