My Skill Lab
CybersecurityIntermediate

SOC Analyst: Threat Detection and SIEM

Logs, alerts, triage and investigations with Splunk and Sentinel-style tools.

Taught by Nisha Poudel · SOC Lead

What you'll learn

  • Describe how a SOC is structured and what an analyst does across a shift
  • Identify the key log sources that feed detection and investigation
  • Write SIEM queries in Splunk and Sentinel-style tools to find suspicious activity
  • Map observed behaviour to MITRE ATT&CK tactics and techniques
  • Triage alerts to separate true positives from false positives
  • Investigate an incident with a playbook and write a clear shift handover

About this course

The security operations centre analyst role is the most common way into cybersecurity, and this course gives you the practical skills to do it well. It is for career changers and IT staff who want to move into a blue-team defensive role. You will learn where security-relevant logs come from, how a SIEM collects and correlates them, and how to write queries that surface real attacks in tools such as Splunk and Microsoft Sentinel. You will map attacker behaviour with the MITRE ATT&CK framework, triage alerts to separate genuine threats from noise, follow investigation playbooks, and hand off cleanly at the end of a shift. By the end you can read logs with intent, investigate an alert methodically, and communicate findings the way a working analyst does.

Course content

7 lessons
  1. 1Inside the Security Operations CentreWhat a SOC does, how it is structured, and the analyst's role across a shift.Preview
  2. 2Log Sources: The Raw Material of DetectionWhere security-relevant logs come from and what each one tells you.
  3. 3SIEM Fundamentals and Query BasicsHow a SIEM collects, indexes, and correlates logs, and how to write your first searches.
  4. 4MITRE ATT&CK and Detection LogicUse the ATT&CK framework to understand attacker behaviour and build meaningful detections.
  5. 5Alert Triage: Signal from NoiseWork an alert queue efficiently and separate real threats from false positives.
  6. 6Investigating an Incident with a PlaybookFollow a structured playbook to investigate a confirmed alert from start to finish.
  7. 7Shift Handover and ReportingCommunicate findings clearly so the next shift and the wider team can act.