Alert Triage Methodology - SkilBrill

SOC Training Alert Triage Methodology

SOC Training

0% Completed

Module 1 — Security Operations Center Foundations

SOC Mission, Functions, and Operating Models

SOC Tiers and Roles: L1, L2, L3 Analysts

Security Frameworks: NIST, MITRE ATT&CK, Cyber Kill Chain

Threat Actors, TTPs, SOC Metrics, and Maturity Models

Module 2 — Network and Endpoint Security Monitoring

Network Protocols and Traffic Analysis

Packet Capture and Analysis with Wireshark

Endpoint Detection and Response Concepts

Sysmon, Windows Event Logs, Linux Logs, and Log Normalization

Module 3 — SIEM Architecture and Use Cases

SIEM Architecture and Data Ingestion

Log Sources, Parsers, and Normalization

Correlation Rules and Alert Logic

Use Case Development, Splunk, Sentinel, and QRadar Basics

Module 4 — Threat Detection and Alert Triage

Alert Triage Methodology

False Positive Reduction Techniques

IOC and IOA Analysis

Memory and Disk Forensics Introduction, Threat Hunting Basics

Module 5 — Incident Response and Handling

Incident Response Lifecycle: Preparation, Detection, Containment

Incident Categorization and Prioritization

Evidence Handling and Chain of Custody

Containment, Eradication, Recovery, and Post-Incident Reporting

Module 6 — Malware Analysis Fundamentals

Malware Types and Behaviors

Static Analysis Techniques and Tools

Dynamic Analysis in Sandbox Environments

YARA Rules, Signature Creation, and Reverse Engineering Basics

Module 7 — Threat Intelligence and Hunting

Threat Intelligence Types: Strategic, Tactical, Operational

TI Platforms and Feeds

Threat Hunting Hypotheses and Methodologies

MITRE ATT&CK Mapping and Intelligence-Driven Detection

Module 8 — Cloud Security Monitoring

Cloud Security Challenges and Shared Responsibility

AWS, Azure, and GCP Logging and Monitoring

Cloud SIEM and Native Security Tools

Container and Kubernetes Security Monitoring and Threat Detection

Module 9 — Phishing and Email Security

Email Threats: Phishing, Spear Phishing, BEC

Email Headers and Trace Analysis

Email Security Gateway Investigation

User Awareness, Reporting Workflows, and Phishing Incident Response

Module 10 — Digital Forensics Basics

Forensic Principles and Legal Considerations

Disk Imaging and File System Analysis

Memory Forensics and Artifacts

Timeline Analysis, Correlation, and Forensic Reporting

Module 11 — SOC Automation and Orchestration

SOAR Platforms and Playbooks

Automation Use Cases in SOC

API Integrations for Enrichment

Case Management, Workflow Automation, and Continuous Improvement

Module 12 — Real-World Projects and Interview Preparation

SOC Alert Triage Simulation

Incident Response Tabletop Exercise

Threat Hunting Campaign Project

SOC Analyst Interview Questions, Resume, and LinkedIn Optimization

Announcements Course Info