1. SOC and Needs of SOC
2. SOC Workflow and Components
3. SOC models and Generations
4. SOC implementation
5. Best practice for running SOC
6. SOC vs NOC
7. Incident, Event and Log
8. Log sources and Log format
9. Logging, monitoring and analysis process
10. Alerting and Reporting
11. Log management tools
12. Logging, monitoring and analysis process
13. Alerting and Reporting
14. Log management tools

1. Introduction to SIEM
2. How do SIEM tools work?
3. Need of SIEM
4. Functions of SIEM

1. Introduction to SIEM
2. How do SIEM tools work?
3. Need of SIEM
4. Functions of SIEM
5. Technology
6. Process
7. Data
8. Data aggregation
9. Security data analytics (reports and dashboards)
10. Correlation and security event monitoring
11. Forensic analysis
12. Incident detection and response
13. Real-time event response or alerting
14. Threat intelligence
15. User and entity behavior analytics
16. IT compliance management

1. Data Collection
2. Data Management
3. Log Retention
4. Log Flow
5. SIEM Integrations

1. Calculating Velocity: Events Per Second-(EPS)
2. Storage Needs
3. Hardware Sizing

1. SolarWinds
2. IBM QRadar
3. Wazuh

1. UnderDefense EDITOR’S CHOICE
2. Ideal Managed SIEM
3. Infradata Managed SIEM
4. Bulletproof Managed SIEM

INTRODUCTION TO SPLUNK

1. Why Splunk
2. What is Splunk
3. Uses of Splunk

WORKING AND ARCHITECTURE OF SPLUNK

Architecture

1. Single server environment and distributed server environment
2. Splunk components
3. Splunk architecture
4. Splunk license management

SPLUNK ENTERPRISE INSTALLATION

1. Splunk Enterprise Installation

INDEXING DATA INTO SPLUNK

1. Indexer and Indexing
2. How indexing works

SPLUNK FORWARDER INSTALLATION
HOW SPLUNK INDEXES DATA

1. Indexes
2. Event types
3. Indexer and Indexer cluster

SEARCHING WITH SPLUNK

1. Basic search and results
2. Using Search assistant
3. Matching Searches
4. Retrieve events from the index
5. Understanding Search result
6. Change the display of the event viewer

VISUALIZING DATA

1. About visualization
2. Visualization from Search
3. Dashboard panel visualization

CREATING ALERT

1. Create and configure custom alert
2. Splunk Report
3. Report creation
4. Report Configuration
5. Modify report search option

1. Detect and Investigate Malware
2. Detect and Stop Data Exfiltration
3. Privileged User Monitoring (PUM)
4. Detect Zero-Day Attacks
5. Use DNS Data to Identify Patient-Zero Malware

1. Functions and Responsibility
2. Choosing IRT
3. SOC and IRT collaboration
4. Evidence gathering and forensic analysis

1. Life cycle
2. Types of CTI
3. Machine Learning for CTI
4. CTI Use Cases

1. Working of IOC
2. Example of IOC
3. Unusual Outbound Network Traffc
4. Geographical Irregularities
5. Anomalies with Privileged User Accounts
6. Substantial Rise in Database Read Volume

BLUE TEAM LABS

1. Phishing analysis
2. Log analysis Sysmon
3. Network analysis -malware compromise
4. Log Analysis compromised wordpress
5. Incident Response Team IRT
6. Functions and Responsibility
7. Choosing IRT
8. SOC and IRT collaboration
9. Evidence gathering and forensic analysis
10. Brute force

LET'S DEFEND

1. Splunk
2. Investigation scenarios
3. Monitoring
4. Logmangment
5. Case Management
6. Endpoint Security

TRY HACKME

1. Intro to defensive security
2. Common attacks
3. Junior Security Analyst Intro
4. Intro to Endpoint Security
5. Unattended
6. New Hire old artifacts
7. Sakura room
8. Wazuh