Module 1: The SOC — Your War Room
Understand where you work, what you protect, and how everything connects.
7 lessons · 6 labs
You'll start seeing related activity across hosts. Don't force a story yet — learn the console, then follow what the data shows.
Path
- Lesson01
Inside the SOC
SOC structure, L1/L2/L3 roles, shift handoffs
- Lesson02
Lesson 1.2 — The Attack Landscape
Kill chain, diamond model, common attack patterns
- Lab03Beginner
Lab 1.1 — Your First Shift: Wazuh Dashboard & Alert Tracing
Get hands-on with the Wazuh SIEM: learn the dashboard, search bar, filters, and alert fields, then trace 3 real alerts through the data pipeline.
- Lesson04
Lesson 1.3 — MITRE ATT&CK for Defenders
Tactics, techniques, sub-techniques
- Lab05Beginner
Lab 1.2 — ATT&CK Mapping
Browser-only: Map APT29 techniques in MITRE ATT&CK Navigator. Color-code detection gaps.
- Lesson06
Lesson 1.4 — Your Weapon System: The SOC Toolkit
Every tool you will master — Wazuh, Velociraptor, MISP, TheHive, Suricata, Shuffle, and more — organized by SOC function with cloud lab access
- Lab07Beginner
Lab 1.3 — Know Your Logs
Tour six core log sources in Wazuh — Windows Security, Linux authentication, firewall, DNS, web access and agent status — with one query each, learn to tell a log source from an event type, and build a reference sheet of what each source tells you.
- Lesson08
Lesson 1.5 — Discover: The Analyst's Portable Search Screen
The OpenSearch Dashboards search screen that also exists in Kibana and Elastic — index patterns, columns, filter pills, the field sidebar and its sampling trap
- Lab09Beginner
Lab 1.4 — Explore the Data with Discover
Switch index patterns to see the raw events behind the alerts, build a readable table, isolate a host with filter pills, and catch the field sidebar's sampling trap in the act.
- Lesson10
Lesson 1.6 — SOC Soft Skills & Career Paths
Communication, teamwork, burnout prevention, L1→L2→L3 career progression
- Lab11Beginner
Lab 1.5 — Navigate Like an Analyst
No quiz, no pressure. Practice navigating Wazuh Dashboard and Discover, write DQL from memory, then work one alert to a written disposition and hand it over in a shift note.
- Lesson12
Lesson 1.7 — Networking for Analysts
The networking every analyst relies on, taught on the lab network itself: private and public addresses, CIDR, zones and firewalls, ports, reading a firewall line, edge NAT, DNS before connection, and relays
- Lab13Beginner
Lab 1.6 — Map the Network
Read the lab network off its two firewalls: which zone each one guards, which ports routine traffic uses between zones, and how edge NAT shows up in the logs — then draw the map.