Training Program

SOC Analyst & SIEM Operations

Become a Tier-2 SOC Analyst by working with the same tools and workflows used in real Security Operations Centres. Learn to investigate alerts using Splunk, Microsoft Sentinel, and Elastic Security, write Sigma detection rules, correlate endpoint, network, and identity data, automate responses with SOAR playbooks, and create meaningful security reports.

intermediate

SOC Analyst & SIEM Operations — training course cover

Course Overview
Course Structure
Tools & Technologies
Training Options

Overview

Course Overview

Security Operations Centres (SOCs) play a critical role in detecting, investigating, and responding to cyber threats. This course prepares you for a Tier-2 SOC Analyst role by providing hands-on experience with leading SIEM platforms, including Splunk, Microsoft Sentinel, and Elastic Security.

You'll learn how a SOC operates, understand analyst workflows, shift handovers, and key performance metrics such as MTTA and MTTR. The course covers how security data from endpoints, networks, identities, cloud services, and SaaS applications is collected and analyzed to identify potential threats.

A strong emphasis is placed on detection engineering and incident investigation. You'll create Sigma detection rules mapped to the MITRE ATT&CK framework, convert them into Splunk SPL and Microsoft Sentinel KQL using pySigma, investigate alerts by correlating data from multiple sources, and document findings for incident response teams.

What you will learn

Operate a Tier-2 SOC queue across Splunk, Microsoft Sentinel and Elastic Security
Triage alerts
Sigma detection rules for common attacker techniques
Investigate incidents at Tier-2 depth
Author SOAR playbooks
Report SOC metrics
Coordinate a cross-functional incident

Curriculum

Course Structure

A modular learning path with theory, hands-on labs, and progressive skill checkpoints.

Module 01SOC Operating Model
Introduction to Security Operations Centers (SOC)
The Purpose and Mission of a SOC
People, Process, and Technology in a SOC
Business Value of a Security Operations Center
Key Takeaways
Lab: Explore a Live SOC Dashboard
Understanding the SOC Ecosystem
SOC and Incident Response: From Detection to Containment
SOC and Threat Intelligence: Turning Information into Action
SOC, GRC, and Business Stakeholders: Aligning Security with Business Goals
Key Takeaways
Lab: Map the SOC Ecosystem
Core Functions of a SOC
Investigation: Separating Threats from Noise
Escalation and Response Coordination: Taking Action Against Threats
Continuous Improvement: Learning from Every Incident
Key Takeaways
Lab: Alert Lifecycle Walkthrough: SIEM to Ticket
SOC Organizational Structures
Distributed SOC: Security Operations Across Multiple Locations
Virtual SOC: Security Without Physical Boundaries
Follow-the-Sun Model: Continuous Security Coverage Across Time Zones
Key Takeaways
Lab: SOC Structure Design: Scenario Exercise
Module 02Telemetry Sources & Sensors
Introduction to Security Telemetry
What is Security Telemetry
The Telemetry Lifecycle
Visibility vs. Detection
Common Security Gaps
Lab 01 — Telemetry Source Mapping: What Are We Collecting?
Understanding Logs and Events
Events vs. Logs vs. Alerts
Log Types
Key Log Attributes for Security Analysis
Lab 02 – Log Format Identification and Field Extraction
Telemetry Collection Architecture
Collection
End-Data Flow
Collection Failure Points
Lab 03 – Configure Filebeat to Ship Logs
Endpoint Telemetry
Windows Events Logs - Critical Security Event IDs
Sysmon — Enhanced Endpoint Visibility
Linux Endpoint Telemetry
EDR Fundamentals
Lab 04 – Sysmon Deep Dive: Process Chain Reconstruction
Module 03SIEM Architecture (Splunk/Sentinel/ELK)
Introduction to SIEM
Purpose of SIEM: Making Sense of Security Data
Detection and Monitoring Use Cases
SIEM in a SOC: The Heart of Security Operations
Key Takeaways
First Contact: Navigate the Elastic SIEM (Lab)
SIEM Components and Architecture
Collectors and Forwarders: Moving Data into the SIEM
Processing Layers: Transforming Raw Logs into Actionable Intelligence
Storage and Search Layers: Enabling Investigation and Threat Hunting
Key Takeaways
Map the SIEM Architecture: Elastic Stack Component Tour (Lab)
Log Ingestion and Data Pipelines
Ingestion Workflows: How Logs Travel Through the SIEM
Agent-Based vs Agentless Collection
Data Flow Concepts: Understanding the Journey of Security Data
Key Takeaways
Onboard a New Log Source: End-to-End Ingestion (Lab)
Parsing and Field Extraction
Field Extraction: Identifying the Most Important Information
Structured vs Unstructured Logs
Data Quality Considerations: Ensuring Reliable Security Visibility
Key Takeaways
Build a Grok Parser for an Unstructured Log (Lab)
Module 04Alert Triage Methodology
What is Alert Triage?
Why Alert Triage is Important
The Goals of Alert Triage
The Role of a Tier-1 SOC Analyst in Alert Triage
Key Takeaways
What is a Security Alert?
Components of a Security Alert
Types of Security Alerts
Why Context Matters During Alert Analysis
Key Takeaways
Why Alert Prioritization Matters
Factors That Influence Alert Priority
Risk-Based Alert Prioritization
Common Mistakes During Alert Prioritization
Key Takeaways
What is the Pyramid of Triage?
Level 1 – Initial Alert Validation
Level 2 – Context and Evidence Collection
Level 3 – Analysis, Decision, and Escalation
Applying the Pyramid During Daily SOC Operations
Key Takeaways
Module 05Sigma Rule Authoring
Introduction to Sigma
What is Sigma?
The Problem Sigma Solves
Sigma in Detection Engineering
Vendor-Agnostic Detections
Anatomy of a Sigma Rule
Rule Structure
Metadata Fields
Required vs. Optional Fields
Understanding Rule Components
Understanding Log Sources
The "logsource" Field
Product, Category, Service
Common logsource Combinations
Mapping Detections to Telemetry
Detection Login Fundamentals
Detection Section Overview
Selections
Conditions and Boolean Logic
Rule Evaluation

Credential

Secure your Completion Certificate

Cyberyami Verified

Industry-recognized — issued under the Cyberyami program.
Shareable directly to LinkedIn and beyond.
Unique ID for employer verification.

Sample certificate of completion for SOC Analyst & SIEM Operations

Stack

Tools & Technologies Covered

The production-grade tools you'll work with across labs and projects.

Splunk Enterprise 9.x (primary lab SIEM)
Microsoft Sentinel
Elastic Security (ELK stack)
Sigma (open detection format)
pySigma / sigma-cli (translation toolchain)
YARA (supplementary)
SigmaHQ rules repository
Sysmon with Olaf Hartong configuration
Windows Event Log
Splunk SOAR
Wireshark
Zeek (Bro) for network telemetry
KQL & SPL query languages
AWS
Kali Linux
Git + GitHub
MITRE ATT&CK framework

Get Started

Duration: 23
Level: Intermediate
Globally Recognized Curriculum

Enrollment

Choose Your Training Path

Flexible learning modes designed to fit your schedule and learning style.

25% OFF
Training Mode
Self Paced
- Full course access available 24/7, on any device
- Learn at your own pace with no fixed schedule
- Hands-on labs in Cyberyami's browser-based virtual environment
- Rewind, pause, and repeat lessons as often as needed
- Practice assessments
- Progress tracking to keep your learning on course
- Lifetime or extended access to course materials and updates
Enroll Now
25% OFF
Training Mode
Instructor Led
- Live sessions led by a certified, industry-experienced instructor
- Real-time Q&A and doubt resolution during class
- Fixed schedule that keeps you accountable and on track
- Guided walkthroughs of complex labs and exam-style scenarios
- Cohort-based learning with peer interaction and discussion
- Session recordings available for revision
- Direct mentorship and personalized exam-readiness guidance
Enroll Now
24% OFF
Training Mode
1 On 1
- Dedicated one-on-one sessions with a certified, industry-experienced instructor
- Personalized learning plan tailored to your goals, skill level, and schedule
- Flexible class timings with the freedom to reschedule when needed
- Individual attention with focused guidance on every concept and lab
- Real-time Q&A and in-depth doubt resolution throughout the sessions
- Customized hands-on lab walkthroughs based on your learning needs
- Personalized feedback on assignments, assessments, and practical exercises
- Exam-focused mentoring with a strategy designed for your certification goals
- Career guidance, interview preparation, and industry best practices
Schedule & Enroll

Begin Today

Hands-on training, real-world labs, and mentor support — built to take you from curious to job-ready.