Udemy
Turn what you know into an opportunity and reach millions around the world.
Learn More
Your cart is empty.
Keep shopping
Splunk SIEM Bootcamp for SOC Analyst
Hot & New
New
Rating: 5.0 out of 5(2 ratings)
17 students

Splunk SIEM Bootcamp for SOC Analyst

Master SPL and MITRE ATT&CK through full Windows SOC investigations — Sysmon, Security, and PowerShell logs
Created byRajneesh Gupta, Jaimin Pathak
Last updated 9/2026
English

What you'll learn

  • Investigate real security incidents in Splunk using Sysmon, Windows Security, and PowerShell logs
  • Write core SPL commands — search, stats, table, timechart, dedup, eval — to find and filter threats
  • 3. Map attacker behavior to MITRE ATT&CK across Discovery, Defense Evasion, and Collection tactics
  • 4. Tell true positives from false positives using evidence, not assumptions or surface-level signals

Course content

6 sections • 33 lectures • 4h 52m total length

  • What is SOC28:48
  • Overview of SOC Tools and Technologies7:32
  • SOC People5:48
  • Understanding SIEM7:17

Requirements

  • No prior SOC, Splunk, or cybersecurity experience required. We start from what a log actually is and build up to full investigations step by step.

Description

This course contains the use of artificial intelligence.


Most Splunk courses teach you commands. This one teaches you to actually think like a SOC analyst.


You'll start with the basics — what a log is, how Splunk searches work, the SPL commands you'll use every day. Then you'll dive into 14 real investigations, built from real Windows logs (Sysmon, Security, PowerShell). Each one starts with just a ticket — no answers given. You'll dig through the evidence, cross-check sources, and decide for yourself: is this an attack, or nothing at all?


Along the way you'll learn to spot the tricks that trip up new analysts — like trusting a signed publisher name that turns out to be irrelevant, or missing the one command-line flag that changes everything.


This course also covers MITRE ATT&CK, so the techniques you investigate map to language the industry actually uses. Every incident is mapped to a real tactic — Discovery, Defense Evasion, Collection — so what you learn here carries directly into interviews and real SOC work, not just this course.


By the end, you won't just know Splunk syntax. You'll have actually investigated something, 14 times over.


No prior experience needed. If you can read a log line, you can start.

Who this course is for:

  • Aspiring SOC analysts
  • cybersecurity career-changers
  • IT professionals moving into security who need hands-on Splunk experience

Report abuse