Defensive Security & Incident Response
For SOC analysts, incident responders and network defenders: monitor logs and network traffic, detect and triage attacks, and communicate findings clearly. Covers log analysis, SIEM detection, threat intelligence, packet analysis and IDS rules.
- Courses
- 2
- Study time
- 18 hours
- Lessons
- 11
- Practice labs
- 11
- Assessments
- 4
Courses in this path
Take them in this order. Each one has lessons, practice labs and an assessment.
Security Monitoring, Log Analysis & Threat Intelligence
Learn what a Security Operations Centre does and how analysts turn raw logs, SIEM alerts and threat intelligence into triaged, documented incidents.
5 lessons, 6 labs, 2 assessments
View course →Network Traffic Analysis & Intrusion Detection
Learn to read packets and flows, apply Wireshark and tshark filters, recognise scanning, beaconing, DNS tunnelling and cleartext credentials, and…
6 lessons, 5 labs, 2 assessments
View course →What you will be able to do
A sample of the skills the courses in this path teach.
- Describe the SOC tiers and the alert triage workflow from detection to ticket
- Identify brute force followed by a successful login in Linux and Windows authentication logs
- Explain packets, flows and the capture points that determine what you can see
- Write correct Wireshark display filters and tshark commands to isolate traffic
Before you start
Basic networking (IP, ports, HTTP) and comfort reading text files; no prior SOC experience needed
Finish every lesson, lab and assessment of a course and you can claim a digitally signed certificate. Finish every course in the path and you can claim a path certificate too.