Description

This curriculum spans the design and operation of a full-scale Security Operations Center, comparable in scope to multi-workshop advisory engagements that address staffing models, detection engineering, cloud and endpoint monitoring, automation, and governance across complex enterprise environments.

Module 1: Establishing and Scaling a Security Operations Center (SOC)

Decide between building an in-house SOC, outsourcing to a managed security service provider (MSSP), or adopting a hybrid model based on organizational scale, threat exposure, and staffing capabilities.
Define SOC shift patterns and staffing ratios to ensure 24/7 coverage while managing analyst fatigue and maintaining incident response readiness.
Select and integrate a Security Information and Event Management (SIEM) platform that supports existing log sources, scalability requirements, and retention policies.
Develop escalation paths and communication protocols for SOC analysts to coordinate with IT, legal, and executive teams during active incidents.
Implement role-based access controls (RBAC) within the SOC to limit data and tool access based on job function and seniority.
Establish performance baselines for key SOC functions, including mean time to detect (MTTD) and mean time to respond (MTTR), to measure operational effectiveness.

Module 2: Threat Intelligence Integration and Operationalization

Curate and prioritize threat intelligence feeds based on industry relevance, source reliability, and alignment with the organization’s threat landscape.
Map external threat indicators (IOCs) to internal detection rules in SIEM and EDR systems to enable proactive alerting.
Design automated workflows to ingest, normalize, and enrich threat data from STIX/TAXII feeds into existing security tools.
Balance the volume of threat intelligence inputs against analyst capacity to avoid alert fatigue and operational overload.
Establish a feedback loop for validating the accuracy of threat intelligence through incident outcomes and false positive analysis.
Coordinate with peer organizations through ISACs to share anonymized threat data while complying with data privacy regulations.

Module 3: Detection Engineering and Alert Tuning

Develop detection rules using MITRE ATT&CK framework techniques to align alerts with known adversary behaviors.
Conduct regular false positive reviews to refine correlation rules and reduce analyst workload without sacrificing coverage.
Implement use case prioritization frameworks to focus detection engineering on high-risk assets and critical business functions.
Integrate endpoint telemetry, network flow data, and cloud logs to create multi-source detection logic that reduces evasion opportunities.
Version-control detection rules using Git to track changes, enable peer review, and support rollback during failures.
Measure detection efficacy through purple teaming exercises and simulate adversary tactics to validate rule coverage.

Module 4: Incident Response Orchestration and Playbook Development

Design standardized incident response playbooks for common scenarios such as ransomware, phishing, and insider threats.
Integrate SOAR platforms to automate containment actions like host isolation, user account disabling, and DNS sinkholing.
Define decision thresholds for automated versus manual response actions based on risk tolerance and system criticality.
Maintain playbook versioning and conduct quarterly reviews to reflect changes in infrastructure and threat tactics.
Conduct tabletop exercises with cross-functional teams to validate playbook completeness and coordination effectiveness.
Log all response actions in a centralized audit trail to support post-incident review and regulatory compliance.

Module 5: Endpoint Detection and Response (EDR) Management

Configure EDR agents to balance telemetry collection with endpoint performance and privacy requirements.
Define EDR alert severity levels based on behavioral analysis, process lineage, and lateral movement indicators.
Implement EDR exclusions carefully to avoid performance issues while ensuring malicious activity isn’t inadvertently bypassed.
Use EDR query languages to conduct threat hunting across endpoints for signs of dormant malware or credential dumping.
Coordinate EDR deployment across operating systems and device ownership models (corporate vs. BYOD) with IT operations.
Integrate EDR data into the SIEM for correlation with network and identity events to improve detection accuracy.

Module 6: Cloud Security Monitoring and Visibility

Deploy cloud-native logging agents (e.g., AWS CloudTrail, Azure Monitor) to capture configuration changes and access events.
Map cloud identities and roles to on-premises identities to maintain consistent user behavior analytics across environments.
Configure real-time alerts for high-risk cloud actions such as public S3 bucket creation or root account usage.
Integrate CSPM (Cloud Security Posture Management) tools with the SOC workflow to prioritize misconfigurations based on exploitability.
Establish monitoring for serverless and containerized workloads, including function execution logs and Kubernetes audit trails.
Negotiate access to cloud provider logs and forensic data in contracts to ensure availability during incident investigations.

Module 7: SOC Automation, Orchestration, and Tool Integration

Select a SOAR platform based on integration capabilities with existing SIEM, ticketing, and endpoint tools.
Develop automated playbooks for repetitive tasks such as DNS lookups, file hash enrichment, and phishing email parsing.
Implement API rate limiting and error handling in automation workflows to prevent tool lockouts and data loss.
Assign ownership for maintaining automation scripts and validating integrations after vendor tool updates.
Use sandboxed environments to test automation logic before deploying to production SOC systems.
Monitor automation success rates and log failures for root cause analysis to maintain operational reliability.

Module 8: SOC Governance, Compliance, and Continuous Improvement

Align SOC operations with regulatory frameworks such as NIST, ISO 27001, and GDPR to support audit readiness.
Conduct regular internal audits of SOC procedures, including log retention, access reviews, and incident documentation.
Develop metrics dashboards for executive reporting that highlight trends in threats, detection performance, and resource utilization.
Implement a formal process for reviewing and updating SOC policies in response to technology changes or audit findings.
Establish a continuous improvement cycle using post-incident reviews (PIRs) to update detection rules and response procedures.
Manage third-party vendor access to SOC systems and ensure their activities are logged and reviewed per contractual SLAs.