SOC Analyst Training with Hands-on to SIEM from Scratch

Explore how network packets travel between machines, how firewalls and gateways translate addresses, and how SOC analysts use packet captures with Wireshark and logs to investigate cyber attacks.

Understand bit, hexadecimal, and bytes representation and apply them to network packets and device logs; read Wireshark captures, navigate list and details panes, and convert between binary, hex, and decimal.

Explore mac addresses and ip addresses, their roles in the physical and network layers, and how arp and ethernet headers enable local communication.

Learn how network address translation (NAT) maps private IPs to a single public IP at the gateway, enabling internal workstations to reach the internet.

Explore PAT as a router technique to map port information and uniquely identify internal systems, using port mapping and NAT to forward packets from gateway to the original requestor.

Learn to capture and read network packets with Wireshark and Tshark, navigate panes, inspect TCP/IP layers, and apply display and capture filters to focus on DNS traffic.

Explore how tcp/ip packets carry source and destination addresses, ports, and state information, and how firewalls and ip databases block or allow traffic using rules and blacklists.

Explore the internet layer and the IP header, learn how packets travel between hops via routers using the routing table, and understand IP’s unreliability, header size, and fields.

Explore ip header fields and their roles in the ip layer, including ipv4 and ipv6, header length, tos, total length, identification, fragmentation flags and offset, ttl, protocol, and header checksum.

Explore the transport layer's role in end-to-end communication, focusing on tcp and udp, tcp reliability, and the tcp header, including the three-way handshake and header fields.

Examine the transport layer tcp header fields, including source and destination ports, sequence and acknowledgment numbers, and the three-way handshake with flags like syn, ack, and fin.

Learn common transport layer attacks, including IP spoofing, fragmentation overlap, and bandwidth abuse, and how syn–ack patterns and firewall logs help SOC analysts detect them.

Learn the four udp header fields: source port, destination port, length, and checksum, and how the checksum validates integrity with receiver recalculation and packet drop on mismatch.

Learn how protocols and ports govern computer communication in tcp/ip, distinguishing communication vs supporting protocols, and identifying 0–255 protocol numbers and 0–65535 ports.

Explore the client-server model and how servers provide services to clients across ports, with common services like DNS, SMTP, DHCP, HTTPS, TELNET, and SSH.

Understand http and https operations, including ssl encryption on port 443, client-server requests (get, post, delete, options), and standard response codes (2xx–5xx) for analyzing web traffic.

Learn how the domain name system translates domain names to IP addresses using port 53 and UDP or TCP, and how caches and authoritative DNS locate the IP.

Learn ftp transfers on ports 20 and 21 for uploading and downloading. Compare telnet on port 23 with ssh on port 22 for encrypted access; review smtp, pop3 and imap.

Explore DNS zone transfer attacks and remediation in network defense. Learn how analysts detect, report, and block unauthorized zone transfers on port 53 and implement preventative firewall controls.

Learn to detect and prevent vulnerability scanning using Nessus, identify vulnerabilities, analyze multiple signatures from attacker scans, correlate events, and block malicious IPs with the firewall via SIEM.

Explore how the ARP protocol maps IP to MAC addresses, and how ARP poisoning and CAM poisoning exploit cached addresses, including gratuitous ARP, with switch-based prevention via port security.

Learn how dos and ddos attacks overwhelm servers with flood traffic, how botnets and amplification techniques like dns amplification cause outages, and practical remediation and prevention measures.

Stores Windows passwords for local and domain accounts. Includes the sam file location, domain accounts stored in Active Directory, and password hashing with MD5 and SHA algorithms.

Discover how Windows authentication protects credentials using hash-based login, NTLM and Kerberos protocols, domain controller and Active Directory, with ticket-based access and encrypted communication.

Investigate Windows and Linux logs to trace activity, detect breaches, and identify login success or failure using event IDs and key Linux files like etc/passwd and etc/shadow.

Explore malware types, delivery methods, including virus, trojan, worm, backdoor, adware, keylogger, RAT, and botnet with C&C and command and control, and how compromised systems escalate privileges and connect back.

Learn how brute force attacks guess user credentials after gaining command prompt access. Understand lockout policies and Windows and Linux event monitoring, including 4625, 4776, 4771, and 0x18 bad password.

Explore phishing attacks that use social engineering to steal credentials via deceptive emails and fake login pages. Learn IOC monitoring, awareness training, and incident response to prevent and investigate breaches.

Identify suspicious activity when a user account is accessed from multiple geo-locations. Investigate exchange server logs, verify with the user, and reset passwords if unauthorized.

Examine malware delivery via email, USB, and compromised sites; identify types (virus, trojan, backdoor, worm, RAT, keylogger) and C&C callbacks, and perform antivirus and manual remediation steps.

Analyze zero-day vulnerabilities and patch management, including remote code execution and buffer overflow exploits, to defend Windows, Linux, and major apps using anomaly-based detection and updated signatures.

Examine how web applications handle http requests and responses, common attacks on servers and clients, cookies and session management, and authentication methods such as basic, digest, ntlm, with https.