Description

This curriculum spans the design and operation of a full-scale security operations center, comparable to multi-workshop programs that integrate threat detection, incident response, network analysis, and compliance activities across complex enterprise environments.

Module 1: SOC Architecture and Operational Design

Decide between centralized, decentralized, or hybrid SOC models based on organizational footprint, data sovereignty requirements, and incident response latency constraints.
Design log retention policies balancing compliance mandates (e.g., PCI DSS, HIPAA) with storage cost and query performance across petabyte-scale environments.
Implement role-based access control (RBAC) for SOC analysts, ensuring segregation of duties between Tier 1 triage, Tier 3 investigation, and administrative functions.
Select between on-premises, cloud-native, or managed SOC solutions based on internal expertise, budget allocation, and control requirements over tooling and data.
Integrate threat intelligence platforms (TIPs) with existing SIEM to automate indicator ingestion while filtering out low-fidelity or irrelevant feeds.
Establish secure communication channels (e.g., TLS-protected APIs, IPsec tunnels) between distributed data collection points and the central SOC platform.

Module 2: Threat Detection Engineering

Develop and tune SIEM correlation rules to reduce false positives from legitimate business process anomalies such as batch job executions or system reboots.
Implement behavioral analytics using baselined network and user activity to detect deviations indicative of lateral movement or data exfiltration.
Deploy custom YARA rules for identifying malicious payloads in memory dumps and file repositories based on malware reverse engineering outputs.
Configure network-based IDS/IPS signatures to detect exploitation attempts while avoiding performance degradation on high-throughput links.
Integrate endpoint detection and response (EDR) telemetry into detection logic to enrich network alerts with host-level context.
Validate detection logic through purple team exercises that simulate adversary tactics, techniques, and procedures (TTPs) in production-adjacent environments.

Module 3: Incident Triage and Response Workflow

Define escalation thresholds for incidents based on data sensitivity, system criticality, and attacker dwell time to prioritize analyst workload.
Implement standardized incident ticketing templates that capture IOCs, affected assets, detection method, and response actions for audit and review.
Orchestrate automated containment actions (e.g., host isolation, user account lockout) with human-in-the-loop approval for high-impact decisions.
Coordinate response activities across IT operations, legal, and PR teams during active breaches while maintaining chain of custody for evidence.
Document decision rationale for delaying or forgoing containment to avoid business disruption during critical operations windows.
Conduct real-time threat hunting during incident response to identify additional compromised assets not detected by automated systems.

Module 4: Network Monitoring and Traffic Analysis

Deploy network taps or SPAN ports at key ingress/egress points to ensure full packet capture without introducing latency or single points of failure.
Configure NetFlow/IPFIX collection from routers and firewalls to identify anomalous traffic volumes or connections to known malicious ASNs.
Decrypt and inspect TLS 1.2/1.3 traffic using SSL/TLS decryption appliances while managing privacy implications and certificate trust chains.
Baseline normal traffic patterns for critical systems to detect beaconing, data staging, or C2 communications using time-series analysis.
Filter out noise from legitimate cloud service traffic (e.g., AWS, O365) to avoid alert fatigue from expected external connections.
Use passive DNS monitoring to detect domain generation algorithm (DGA) usage and fast-flux infrastructure associated with botnets.

Module 5: Threat Intelligence Integration and Application

Evaluate commercial, open-source, and ISAC threat feeds based on timeliness, accuracy, and relevance to the organization’s sector and infrastructure.
Map external threat reports to MITRE ATT&CK to identify gaps in current detection coverage and prioritize rule development.
Automate IOC ingestion into firewalls, EDR, and email gateways while implementing expiration policies to prevent stale blocklists.
Conduct attribution analysis cautiously, focusing on TTPs rather than actor names to avoid geopolitical or legal complications.
Share anonymized IOCs with trusted industry partners via automated platforms like MISP while adhering to data sharing agreements.
Track adversary infrastructure lifecycle to anticipate command-and-control migrations and proactively update defensive controls.

Module 6: Forensics and Evidence Handling

Preserve volatile memory from compromised systems using forensic tools like FTK Imager or Velociraptor before powering down affected hosts.
Establish a forensic workstation with write-blockers and chain-of-custody logging to maintain evidence integrity for legal proceedings.
Extract and analyze Windows event logs, prefetch files, and registry hives to reconstruct attacker activity and persistence mechanisms.
Use network packet captures to validate or refute timeline assertions made during host-based forensic analysis.
Document forensic procedures in standard operating guides to ensure consistency across analysts and support peer review.
Coordinate with external law enforcement or forensic firms only after legal counsel approves data disclosure and jurisdictional risks are assessed.

Module 7: Compliance, Auditing, and Reporting

Generate audit-ready reports mapping SOC activities to regulatory frameworks such as NIST 800-53, ISO 27001, or SOC 2 controls.
Configure logging on all security tools to capture administrative changes, ensuring accountability and supporting internal audits.
Respond to external auditor requests for incident data without disclosing sensitive TTPs or ongoing investigations.
Measure and report mean time to detect (MTTD) and mean time to respond (MTTR) to demonstrate operational effectiveness to executive leadership.
Conduct quarterly control validation exercises to verify that detection rules, firewall policies, and access controls remain effective.
Archive incident records according to legal hold policies, especially when litigation or regulatory investigations are anticipated.

Module 8: Continuous Improvement and Maturity Assessment

Conduct post-incident reviews (PIRs) to identify process breakdowns and update runbooks, ensuring lessons are institutionalized.
Use maturity models (e.g., CIS Critical Security Controls) to benchmark SOC capabilities and prioritize investment in tooling or staffing.
Rotate analysts through red team or threat research roles to improve detection engineering and adversarial thinking.
Measure detection coverage across MITRE ATT&CK to identify under-defended tactics such as credential access or defense evasion.
Implement feedback loops from incident response outcomes to refine alert thresholds and reduce analyst fatigue.
Stress-test SOC operations through simulated surge events to evaluate staffing levels, tool scalability, and communication protocols.