Roadmap
Guided progression
INTERMEDIATE5 lessons5 quizzes
SIEM Query Fundamentals
SIEM platforms are the operational core of most SOC environments. Analysts spend the majority of their working time writing queries, investigating alerts, and building searches that surface attacker behavior in log data. This course covers SIEM querying as a practical skill. Not the theory of log analysis, but the mechanics of writing queries that find real threats in real data.
Course snapshot
Reinforcement
5 quiz-backed lessons
Availability
Ready to open now
Course syllabus
Lessons in sequence
Move through each lesson in order to build the core concepts, then validate your understanding where quizzes are available.
1
Quiz included
SIEM Data Models and Log Normalization
Lesson 1 of 5 in this course sequence.
2
Quiz included
Aggregation and Statistical Analysis for Threat Detection
Lesson 2 of 5 in this course sequence.
3
Quiz included
Time-Series Analysis and Multi-Source Correlation
Lesson 3 of 5 in this course sequence.
4
Quiz included
Query Tuning, Lookup Tables, and Production Operations
Lesson 4 of 5 in this course sequence.
5
Quiz included
Designing a Detection Program with SIEM Queries
Lesson 5 of 5 in this course sequence.