Defensive Security: SOC, Detection and Response

About this course

Defenders spot attacks early and contain them before damage spreads. This course teaches the daily work of a security operations centre (SOC) analyst and a detection engineer: collecting the right logs, writing detections, triaging alerts quickly, hunting for threats no rule caught, and running incident response.

You will join Mangrove Market's small SOC. Using practice log data from the app, staff accounts, store devices and the cloud, you will choose the logs that matter, write detection rules mapped to MITRE ATT&CK, triage a queue of real-looking alerts, hunt for a quiet attacker, and lead the response to a ransomware attempt on store back-office PCs, following the NIST incident response life cycle. Every exercise runs in your browser against data written for the course.

Each lesson has a podcast episode, diagrams, checkpoints, a quiz, flashcards and hands-on SQL or JavaScript exercises. The capstone is a full investigation of a store PC intrusion, with a timeline, new detections and an incident report with lessons learned.

What you will be able to do

• Choose, collect and query the logs that matter for detection
• Write and tune detection rules mapped to MITRE ATT&CK
• Triage alerts quickly and escalate with the right evidence
• Hunt for threats with hypotheses and data
• Run incident response from detection to recovery and lessons learned

Syllabus

6 stops, about 3.5 h in total. Each stop fills in when you complete the lesson.

1. 1

   Inside a SOC

   A security operations centre (SOC) is the team that watches a company's systems, catches attacks early and contains them before damage spreads. This lesson walks you through what a SOC does, who does it, the tools they use and the numbers that tell them how they are doing, by spending a shift inside Mangrove Market's small SOC. By the end you will read a job advert for a SOC analyst and know exactly what the work is.

   30 minIntermediateEpisode1 exercise

   SOC operationsAlert triageSIEM

2. 2

   Logs that matter

   You cannot detect what you do not log, but logging everything drowns you in noise and cost. This lesson shows you how to choose log sources by the questions you need to answer, pull the high-value events from identity, endpoint, network, cloud and application logs, put time and fields into one shape, and query them fast enough to use in a real investigation.

   30 minIntermediateEpisode1 exercise

   Log analysisSIEMEDR

3. 3

   Writing detections

   A detection turns a hunch into a rule that runs every minute without you. This lesson shows how to go from "an attacker would do X and it would look like Y in our logs" to a portable rule in Sigma, mapped to MITRE ATT&CK, tuned for a low false-positive rate and shipped as code with tests, so the next analyst trusts it and the attacker cannot shrug it off.

   35 minIntermediateEpisode1 exercise

   Detection engineeringSigmaMITRE ATT&CKDetection as code

4. 4

   Triage and investigation

   An alert queue never ends, and most alerts are not attacks. This lesson gives you a repeatable way to work one alert at a time: read its intent, gather context around the people and machines it names, build a short timeline, reach a verdict you can defend, and hand a real incident to the next tier with the evidence they need. The goal is to answer three questions fast and the same way every time: is this real, how bad is it, and what happens next.

   30 minIntermediateEpisode1 exercise

   Alert triageEnrichmentEvidence and escalation

5. 5

   Threat hunting

   Your detections and your alert queue only catch what someone already wrote a rule for. Threat hunting is the proactive search for the attacker who slipped past all of them. This lesson shows you how to start from a hypothesis instead of an alert, baseline what normal looks like so you can spot the outliers, and turn every successful hunt into a new detection so you never have to hunt the same thing twice.

   35 minIntermediateEpisode1 exercise

   Threat huntingMITRE ATT&CKLog analysis

6. 6

   Incident response

   One alert at 2 a.m. can become a day that decides how much a company loses. This lesson takes you through the full incident response life cycle, from the moment a detection fires to the review weeks later, using a ransomware attempt on a Mangrove Market store PC. You will learn to run an incident calmly: declare and size it, contain it without destroying evidence, remove the attacker, recover safely, and turn the whole thing into detections that catch the next one sooner.

   35 minIntermediateEpisode1 exercise

   Incident responseMITRE ATT&CKEDR

7. Capstone: Catch and contain the store PC intrusion

   A realistic project with a rubric and a model answer.

8. Final exam and certificate

   10 questions drawn at random, 70% to pass.

Capstone project

Check what you know

Questions