Professional & investigative
From "the server is slow" to "this is an incident, and here is what we do" in four weeks
System administrators and helpdesk staff already see the first signs of most incidents; they just do not have the method to confirm, contain and report them. This course gives the method: how to read logs and alerts, how to investigate a phishing mail or a suspicious process, how to run an incident from detection to lessons learned, and what CERT-In and your own policies require along the way.
- Duration
- 4 weeks, part-time
- Format
- Online / Onsite
- Language
- English
- Level
- Intermediate
- Group size
- 8 to 25
- Certificate
- Completion certificate on passing the final lab
- For
- IT staff moving into security
What participants can do afterwards
- Read Windows, Linux, firewall, proxy, email and cloud logs for signs of compromise, and know which sources matter for which question
- Triage alerts in a SIEM or EDR console: true positive, false positive, needs escalation, with documented reasoning
- Investigate a phishing email end to end: headers, URLs, attachments, sandboxing, and the users who clicked
- Perform first-response on a suspected compromised host: isolation, volatile data, timeline, and when to call for forensics
- Run an incident using a standard lifecycle: detection, analysis, containment, eradication, recovery, lessons learned
- Write an incident report and complete CERT-In reporting within the required time, with the evidence preserved
Modules
Week 1: foundations and logs
How attacks unfold, the SOC role, log sources and what each one shows, timelines, and a lab on finding a brute-force attack and a web-shell in real logs.
Week 2: alerts, phishing and malware
SIEM and EDR triage, phishing investigation, URL and attachment analysis, sandboxing, indicators, and a lab on a credential-phishing campaign.
Week 3: host and network response
Compromised endpoints and servers, isolation, volatile data, persistence, lateral movement, ransomware precursors, and a lab on a live host investigation.
Week 4: incident handling and reporting
The incident lifecycle, playbooks, communication, CERT-In directions and timelines, DPDP breach duties, the incident report, and the final assessed lab.
Throughout: tooling
Open-source SIEM, EDR and analysis tools set up in a shared lab, so participants practise on real consoles rather than slides.
Who should attend
- System and network administrators moving into security roles
- Helpdesk and IT support staff who want to join or build a SOC
- IT managers at SMEs who are the de facto security team
- Fresh graduates with some IT experience aiming for an analyst role
- MSP and IT services staff who handle client incidents
Included
- Eight live sessions over four weeks (two evenings or one weekend day a week), recorded
- A shared lab environment with logs, consoles and prepared incidents
- Playbook templates for phishing, malware, compromised account and ransomware
- An incident report template and a CERT-In reporting checklist
- Completion certificate on passing the final lab, and a reading list for further certification
Frequently asked questions
What background do I need?
Working knowledge of Windows and Linux administration, basic networking (IP, DNS, HTTP, firewalls) and comfort with a command line. If you can set up a server, troubleshoot a network problem and read a log file, you are ready. No programming is required, though a little scripting helps in the log-analysis labs and we provide the snippets.
How much time does it take each week?
Two live sessions of about two and a half hours each, plus three to five hours of lab work at your own pace. The labs are the point of the course, so plan for the full commitment. Sessions are recorded for anyone who misses one, and the lab environment stays available for two weeks after the course ends.
Will this get me a SOC analyst job?
It gives you the skills a first-line analyst uses every day and a portfolio of labs you can discuss in an interview. It is not an accredited certification and we make no placement claims. Many participants go on to a vendor-neutral certification, and the reading list points to those. Employers hiring analysts care most about whether you can triage and investigate, which is what the course drills.
Can this be run in-house for our IT team?
Yes. For an organisation building a security function, we run the course for the IT team with the labs adapted to your log sources and tools where practical, and the week-four module built around your actual incident policy and CERT-In obligations. The final lab can be a tabletop on your environment, which doubles as a readiness test.
Request this program
Tell us the audience, headcount, city and preferred dates. We reply with an outline and quote.