Skip to main content
Log in

Security Monitoring, Log Analysis & Threat Intelligence

Learn what a Security Operations Centre does and how analysts turn raw logs, SIEM alerts and threat intelligence into triaged, documented incidents. You will analyse Linux, Windows, web and email evidence and map activity to MITRE ATT&CK.

Defensive Security & Incident Response
Level
Intermediate
Study time
9 hours
Lessons
5
Practice labs
6
Assessments
2
Format
Self-paced, online

What you will learn

By the end of this course you will be able to:

  • Describe the SOC tiers and the alert triage workflow from detection to ticket
  • Identify brute force followed by a successful login in Linux and Windows authentication logs
  • Recognise scanning and SQL injection attempts in web server access logs
  • Analyse email headers (SPF/DKIM/DMARC, Received chain) to judge whether a message is phishing
  • Map an incident timeline to MITRE ATT&CK techniques and use IOCs from threat intelligence
  • Write a concise incident ticket with evidence, impact, severity and next actions

Before you start

Basic networking (IP, ports, HTTP) and comfort reading text files; no prior SOC experience needed

Tools you will use

  • grep / awk
  • Windows Event Viewer concepts
  • SIEM query console (simulated)
  • MITRE ATT&CK Navigator (reference)

Course outline

5 lessons in 2 modules.

Module 1: Monitoring Foundations

  • What a SOC does and the triage workflow
  • Key log sources: Linux, Windows, web and network

Module 2: Detection and Intelligence

  • SIEM concepts, detection rules and alert fatigue
  • Threat intelligence, IOCs and MITRE ATT&CK
  • Writing a concise incident ticket

Practice labs and assessments

Labs run in the browser as simulations. They never touch a real system.

6 practice labs

  • Brute force then success: reading auth.log Beginner, 25 min
  • Hunting scanners and SQL injection in access logs Intermediate, 30 min
  • Windows Security event extract analysis Intermediate, 30 min
  • Reading a phishing email's headers Intermediate, 25 min
  • Mapping an incident timeline to ATT&CK Intermediate, 25 min
  • SIEM investigation console Advanced, 40 min, final lab

2 assessments

  • Knowledge check: monitoring foundations
  • Final quiz: security monitoring and threat intelligence

The pass mark is 70%. You can retake an assessment.

Take Security Monitoring, Log Analysis & Threat Intelligence

Request access and your instructor will set up your account.

Log in