Security Operations Centre (SOC)

Module 1. Introduction to Security Operations Centre

Covers the purpose, mission, and organisational role of a SOC including its objectives, the SOC lifecycle, and how it protects an organisation’s digital assets. Learners explore SOC goals, team structures, key responsibilities, and operational processes.

Module 2. Cyber Threat Landscape & Attack Methodologies

Introduces the modern cyber threat environment, common adversary tactics, and indicators of compromise (IoCs). Students learn about different types of attacks, threat actors, and how incidents unfold across networks and systems.

Module 3. Security Monitoring Technologies

Focuses on essential SOC tools and platforms such as Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), and firewalls. This module covers how to deploy, configure, and integrate these technologies for effective log collection, correlation, and alert generation.

Module 4. Log Management and Event Correlation

Teaches how to collect, normalise, and analyse logs from different sources to detect security events. Learners will understand log types, event correlation logic, alert tuning, and how to differentiate between benign and suspicious activities.

Module 5. Threat Detection and Intelligence

Explores advanced detection techniques using threat intelligence, blending internal SOC data with external context. Topics include using frameworks like MITRE ATT&CK, threat hunting fundamentals, and prioritising alerts to reduce noise and false positives.

Module 6. Incident Response & Mitigation

Provides a systematic walkthrough of the incident response lifecycle, from identification and triage to containment, eradication, and recovery. Learners practise crafting response playbooks and coordinating with other teams during an active threat.

Module 7. SOC Processes, Metrics & Reporting

Covers SOC operational best practices, including workflow management, performance measurement, key performance indicators (KPIs), and metrics such as time‑to‑detect and time‑to‑respond. The module also focuses on producing actionable reports for technical and executive stakeholders.

Module 8. Hands‑On Labs & Case Studies

Engages students in practical exercises and real‑world scenarios using SOC tools and simulated environments. Labs reinforce monitoring, detection, and response skills with guided tasks and examples drawn from actual incident data.

Module 9. Emerging Trends & SOC Automation

Examines automation and orchestration in SOC operations including workflow automation, machine learning for anomaly detection, and how modern SOCs use automation to improve efficiency and reduce response times.

Module 10. Capstone Simulation Project

Applies all course concepts to a comprehensive simulated SOC engagement. Students perform threat detection, triage alerts, and respond to incidents based on a realistic scenario, concluding with a structured incident report.