Description

This curriculum spans the design and operational refinement of a modern SOC, comparable in scope to a multi-phase advisory engagement focused on threat detection, automation, and governance across cloud, endpoint, and identity systems.

Module 1: Threat Intelligence Integration and Operationalization

Select and configure threat intelligence platforms (TIPs) to aggregate feeds from commercial, open-source, and ISAC providers while filtering noise and false positives.
Map MITRE ATT&CK techniques to internal telemetry sources to prioritize intelligence based on organizational exposure.
Establish automated workflows to enrich SIEM alerts with contextual threat data using STIX/TAXII protocols.
Define ownership and SLAs for threat intel validation, ensuring timely feedback loops between analysts and intelligence teams.
Implement confidence scoring for threat indicators to guide escalation thresholds and reduce over-alerting.
Conduct quarterly intel source effectiveness reviews, discontinuing underperforming feeds based on detection contribution metrics.

Module 2: Advanced Detection Engineering with Sigma and YARA

Develop Sigma rules to detect lateral movement across hybrid environments, ensuring compatibility with diverse SIEM backends.
Write YARA rules to identify malicious document templates in email gateways and endpoint repositories.
Validate detection logic in staging environments using red team emulation data to minimize false positives.
Integrate detection rules into version-controlled repositories with peer review and change management processes.
Balance detection sensitivity and performance by adjusting rule thresholds based on system resource constraints.
Rotate and deprecate legacy rules that no longer align with current threat actor TTPs or generate excessive noise.

Module 3: SOAR Playbook Design and Execution

Design automated playbooks for phishing triage that parse email headers, extract IOCs, and initiate quarantine actions.
Orchestrate cross-tool workflows between EDR, firewalls, and identity providers using API-based integrations.
Implement conditional branching in playbooks to handle multi-factor authentication exceptions during account lockout procedures.
Log all automated actions with immutable audit trails to support forensic reconstruction and compliance reporting.
Evaluate playbook efficacy by measuring mean time to containment before and after automation deployment.
Enforce approval gates for high-impact actions such as host isolation or DNS blackholing to prevent unintended outages.

Module 4: Cloud-Native Threat Detection and Monitoring

Configure AWS GuardDuty and Azure Defender alerts to detect anomalous API calls indicative of credential compromise.
Deploy CloudTrail and Azure Monitor log aggregations with centralized parsing rules for consistent event normalization.
Instrument serverless functions with custom logging to capture execution anomalies missed by native monitoring tools.
Map cloud IAM roles to least privilege principles and monitor for policy changes that expand permissions.
Correlate container runtime events from EKS and AKS with network egress patterns to detect cryptomining activity.
Respond to cloud storage bucket exposure incidents by automating access revocation and initiating data leakage assessments.

Module 5: Endpoint Detection and Response (EDR) Tuning and Management

Adjust EDR behavioral detection sensitivity to reduce false positives in development and CI/CD environments.
Deploy custom EDR queries to detect suspicious PowerShell and WMI activity across Windows endpoints.
Enforce EDR agent update policies through configuration management tools like Intune or Jamf.
Conduct live response investigations using EDR console tools to collect memory dumps and process trees during active incidents.
Integrate EDR telemetry with SIEM using standardized schema mappings to enable cross-platform correlation.
Manage EDR license allocation by identifying and decommissioning stale or non-compliant endpoints.

Module 6: Incident Triage and Escalation Protocols

Classify incoming alerts using a standardized severity matrix that incorporates asset criticality and threat context.
Document triage decisions in ticketing systems with reproducible steps to support peer validation and training.
Initiate incident escalation paths based on predefined criteria such as data exfiltration volume or executive account compromise.
Preserve volatile evidence from endpoints and network devices before containment actions alter system state.
Coordinate with legal and PR teams when handling incidents with regulatory or reputational implications.
Conduct post-triage reviews to refine detection rules and reduce repeat investigations for known benign patterns.

Module 7: Threat Hunting in Mature Environments

Develop hypothesis-driven hunts based on emerging threat reports, focusing on undetected persistence mechanisms.
Leverage endpoint telemetry to identify anomalous scheduled tasks and service installations across workstations.
Query DNS logs for rare domain resolutions that may indicate beaconing to C2 infrastructure.
Use memory analysis tools to uncover userland rootkits evading traditional file-based scans.
Measure hunt effectiveness by tracking dwell time reduction and number of novel TTPs identified.
Rotate hunting focus areas quarterly to prevent blind spots in coverage, such as identity or supply chain risks.

Module 8: SOC Governance, Metrics, and Continuous Improvement

Define and track KPIs such as alert-to-incident ratio, mean time to acknowledge, and detection coverage by MITRE tactic.
Conduct quarterly tabletop exercises to validate incident response playbooks under realistic constraints.
Perform staffing workload analysis to adjust shift coverage based on alert volume and incident complexity trends.
Review SIEM retention policies to balance forensic readiness with storage cost and compliance requirements.
Standardize runbooks with decision trees and escalation checklists to reduce analyst decision fatigue.
Establish a feedback loop between Tier 1 analysts and detection engineers to refine alerting logic based on operational experience.