Security Operations and Cyber Defense

This applied level moves learners from foundational protection into monitoring, analysis, and incident response, with practical emphasis on SOC workflows.

Level Goals

• Analyze network traffic, logs, and security alerts.
• Understand SOC workflows and core SIEM concepts.
• Manage vulnerabilities and apply incident response processes.

Training Modules

• Network security, traffic analysis, and IDS/IPS concepts.
• Windows, Linux, authentication, and web-service logs.
• Log collection, event correlation, and alert analysis.
• Asset discovery and vulnerability scanning.
• CVE, CVSS, prioritization, remediation, and verification.
• Web application security fundamentals.
• Detection, analysis, containment, eradication, and recovery.
• Indicators of compromise and basic threat intelligence.

Practical Work

• Analyze logs, traffic, and security events.
• Investigate alerts and correlate related activity.
• Assess vulnerabilities and prioritize remediation.

Applied Project

Investigate a simulated incident, determine its scope and likely cause, recommend response actions, and produce a professional incident report.

Expected Outcomes

• Detect suspicious activity through logs and traffic.
• Work with foundational SOC and SIEM workflows.
• Assess and prioritize vulnerabilities.
• Structure incident response and professional documentation.

Prerequisites

• Successful completion of Level 1 is mandatory.
• Direct entry to Level 2 is not permitted.

Progression Requirement

Completion of this level, its assessments, and project is required before Level 3.