Course 1
Security Foundations
0/8 lessons complete0%
Learning PathsSOC Analyst
Learning path
SOC Analyst
Build operational skill in monitoring, detection, triage, hunting, and response.
This path groups the courses for one direction. Use it to understand the sequence, then open the specific course you want to work through.
Courses
24
Modules
24
Lessons
153
Completion
0%
0 of 153 lessons completed ยท Active module: Security Foundations0%
Courses in this path
Open the course you want to work through
This path groups related courses into one branch. Course pages stay focused on the lesson-by-lesson workspace.
8 lessons
Course 2
Networking Foundations
0/8 lessons complete0%
Course 3
Threat Landscape and Attacker Thinking
0/6 lessons complete0%
Course 4
Operating Systems for Defenders
0/6 lessons complete0%
Course 5
Cryptography Essentials
0/7 lessons complete0%
Course 6
Defensive Web Fundamentals
0/8 lessons complete0%
Course 7
Identity and Access Management
0/7 lessons complete0%
Course 8
System Hardening Fundamentals
0/6 lessons complete0%
Course 9
Logging, Monitoring, and Telemetry
0/6 lessons complete0%
Course 10
Blue Team Operations
0/6 lessons complete0%
Course 11
Security Governance and Program Foundations
0/6 lessons complete0%
Course 12
Cloud Security Foundations
0/6 lessons complete0%
Course 13
SOC Analyst Fundamentals
0/7 lessons complete0%
Course 14
Detection Engineering
0/7 lessons complete0%
Course 15
Incident Response Operations
0/7 lessons complete0%
Course 16
Threat Hunting Fundamentals
0/7 lessons complete0%
Course 17
Threat Intelligence for SOC Analysts
0/6 lessons complete0%
Course 18
SIEM Query Fundamentals
0/5 lessons complete0%
Course 19
Writing Detections with ATT&CK
0/5 lessons complete0%
Course 20
SOC Analyst Capstone
0/6 lessons complete0%
Course 21
Applied Malware Analysis for Defenders
0/6 lessons complete0%
Course 22
Advanced Threat Hunting
0/6 lessons complete0%
Course 23
Incident Response Leadership
0/6 lessons complete0%
Course 24
Security Operations Program Design
0/5 lessons complete0%
Module preview
What this path covers
Preview the modules and lesson sequence here, then use each course page when you want the full execution view.
Module 10/8 completeCurrent module
Security Foundations
You are currently working through Security Purpose and Defensive Outcomes in this module.
Preview lessons
- Security Purpose and Defensive OutcomesCurrent
- Confidentiality, Integrity, and AvailabilityLocked
- Authentication, Authorization, and AccountabilityLocked
+5 more lessons in this module
Module 20/8 complete
Networking Foundations
Complete the lessons in sequence to move this path forward.
Preview lessons
- Network Layers and Why They MatterLocked
- Network Identity: IP Addresses, MAC Addresses, and AttributionLocked
- Ports, Protocols, and ServicesLocked
+5 more lessons in this module
Module 30/6 complete
Threat Landscape and Attacker Thinking
Complete the lessons in sequence to move this path forward.
Preview lessons
- Attacker Motivations and ObjectivesLocked
- The Shape of an ATT&CKLocked
- Initial Access PatternsLocked
+3 more lessons in this module
Module 40/6 complete
Operating Systems for Defenders
Complete the lessons in sequence to move this path forward.
Preview lessons
- Processes, Users, and the Idea of Security ContextLocked
- Windows Essentials for DefendersLocked
- Linux Essentials for DefendersLocked
+3 more lessons in this module
Module 50/7 complete
Cryptography Essentials
Complete the lessons in sequence to move this path forward.
Preview lessons
- Cryptography Purpose and Defender ContextLocked
- Symmetric CryptographyLocked
- Asymmetric CryptographyLocked
+4 more lessons in this module
Module 60/8 complete
Defensive Web Fundamentals
Complete the lessons in sequence to move this path forward.
Preview lessons
- Web Architecture and Request FlowLocked
- URLs, Domains, DNS, and HostingLocked
- HTTPS and TLS in the BrowserLocked
+5 more lessons in this module
Module 70/7 complete
Identity and Access Management
Complete the lessons in sequence to move this path forward.
Preview lessons
- Identity, Accounts, and the Identity LifecycleLocked
- Authentication Factors and Modern AuthenticationLocked
- Federated Identity: SSO, OAuth, and OpenID ConnectLocked
+4 more lessons in this module
Module 80/6 complete
System Hardening Fundamentals
Complete the lessons in sequence to move this path forward.
Preview lessons
- System Hardening Purpose and Defensive ValueLocked
- Configuration Baselines and BenchmarksLocked
- Patch ManagementLocked
+3 more lessons in this module
Module 90/6 complete
Logging, Monitoring, and Telemetry
Complete the lessons in sequence to move this path forward.
Preview lessons
- High-Quality Security TelemetryLocked
- The Major Log Sources Every Defender Should KnowLocked
- SIEM, Log Management, and the Detection PlatformLocked
+3 more lessons in this module
Module 100/6 complete
Blue Team Operations
Complete the lessons in sequence to move this path forward.
Preview lessons
- Blue Team Mission and Daily WorkLocked
- The Incident LifecycleLocked
- SOC Structure and Analyst RolesLocked
+3 more lessons in this module
Module 110/6 complete
Security Governance and Program Foundations
Complete the lessons in sequence to move this path forward.
Preview lessons
- Security Governance Purpose and Operating ModelLocked
- The Framework and Regulatory LandscapeLocked
- Risk Management: Identification, Assessment, and TreatmentLocked
+3 more lessons in this module
Module 120/6 complete
Cloud Security Foundations
Complete the lessons in sequence to move this path forward.
Preview lessons
- Cloud Security Model and Shared ResponsibilityLocked
- The Shared Responsibility ModelLocked
- Cloud Identity and Access ManagementLocked
+3 more lessons in this module
Module 130/7 complete
SOC Analyst Fundamentals
Complete the lessons in sequence to move this path forward.
Preview lessons
- The SOC Analyst Role in DepthLocked
- A Structured Methodology for Alert TriageLocked
- Investigation Deep Dive: Pivoting Through TelemetryLocked
+4 more lessons in this module
Module 140/7 complete
Detection Engineering
Complete the lessons in sequence to move this path forward.
Preview lessons
- Detection Engineering Purpose and WorkflowLocked
- Building Detections from Threat to RuleLocked
- Testing and Validating DetectionsLocked
+4 more lessons in this module
Module 150/7 complete
Incident Response Operations
Complete the lessons in sequence to move this path forward.
Preview lessons
- The IR Role in DepthLocked
- Initial Incident Response: The First HourLocked
- Containment Strategy: Short-Term and Long-Term Trade-OffsLocked
+4 more lessons in this module
Module 160/7 complete
Threat Hunting Fundamentals
Complete the lessons in sequence to move this path forward.
Preview lessons
- Threat Hunting Purpose and PracticeLocked
- Hypothesis-Driven Hunting: A Structured ApproachLocked
- Data-Driven Hunting and Long-Tail SignalsLocked
+4 more lessons in this module
Module 170/6 complete
Threat Intelligence for SOC Analysts
Complete the lessons in sequence to move this path forward.
Preview lessons
- Threat Intelligence Purpose and PracticeLocked
- Sources and Evaluating IntelligenceLocked
- Applying Intelligence in OperationsLocked
+3 more lessons in this module
Module 180/5 complete
SIEM Query Fundamentals
Complete the lessons in sequence to move this path forward.
Preview lessons
- SIEM Data Models and Log NormalizationLocked
- Aggregation and Statistical Analysis for Threat DetectionLocked
- Time-Series Analysis and Multi-Source CorrelationLocked
+2 more lessons in this module
Module 190/5 complete
Writing Detections with ATT&CK
Complete the lessons in sequence to move this path forward.
Preview lessons
- ATT&CK as a Detection Coverage FrameworkLocked
- Initial Access and Execution DetectionsLocked
- Persistence and Credential AccessLocked
+2 more lessons in this module
Module 200/6 complete
SOC Analyst Capstone
Complete the lessons in sequence to move this path forward.
Preview lessons
- Initial Alert Triage: Monday 9:23 AmLocked
- Investigation Expansion: Monday 10:00 AmLocked
- Containment and Eradication: Monday to WednesdayLocked
+3 more lessons in this module
Module 210/6 complete
Applied Malware Analysis for Defenders
Complete the lessons in sequence to move this path forward.
Preview lessons
- Lab Setup and Analysis FundamentalsLocked
- Static AnalysisLocked
- Dynamic AnalysisLocked
+3 more lessons in this module
Module 220/6 complete
Advanced Threat Hunting
Complete the lessons in sequence to move this path forward.
Preview lessons
- The Peak Hunting FrameworkLocked
- Hunting Living-Off-The-Land TechniquesLocked
- Cloud Threat HuntingLocked
+3 more lessons in this module
Module 230/6 complete
Incident Response Leadership
Complete the lessons in sequence to move this path forward.
Preview lessons
- The Incident Commander RoleLocked
- Multi-Team Coordination During IncidentsLocked
- Communication Under PressureLocked
+3 more lessons in this module
Module 240/5 complete
Security Operations Program Design
Complete the lessons in sequence to move this path forward.
Preview lessons
- SOC Operating ModelsLocked
- Staffing and Shift DesignLocked
- Alert Management and SLA DesignLocked
+2 more lessons in this module