Month 8 – Security Operations Center (SOC) & Incident Response (Blue Team)

Note: This month focuses on defending systems, detecting suspicious activity, and responding to cybersecurity incidents.

Topic	What I Will Discuss	Tool	What We Use the Tool For	Practical	Theory Assessment	Practical Assessment
Introduction to SOC (Security Operations Center)	What a SOC is, SOC roles, Tier 1–3 analysts, how a SOC operates.	Microsoft Sentinel (Lab)	To monitor and investigate security events from different systems.	Explore the Microsoft Sentinel dashboard and identify security alerts.	Define a SOC and explain its functions.	Navigate the SIEM dashboard and identify security alerts.
Security Monitoring	Continuous monitoring, logs, alerts, detection methods.	Splunk	To monitor systems and identify suspicious activities.	Import sample logs into Splunk and search for events.	Explain why continuous monitoring is important.	Search and identify suspicious events in logs.
Log Analysis	Types of logs, login logs, event logs, application logs, web server logs.	Splunk	To analyze system and application logs.	Review Windows event logs and identify failed logins.	Explain different log types.	Analyze logs and identify unusual activities.
Security Information and Event Management (SIEM)	SIEM architecture, data collection, correlation, dashboards, reporting.	Microsoft Sentinel	To collect, correlate, and analyze security events.	Connect sample data and create a simple dashboard.	Explain how SIEM improves security monitoring.	Build a dashboard showing security events.
Threat Intelligence	Threat feeds, Indicators of Compromise (IOCs), Indicators of Attack (IOAs), threat sharing.	AlienVault OTX	To research known threats and indicators.	Search for known IOCs in AlienVault OTX.	Define threat intelligence and IOCs.	Identify malicious indicators from a threat feed.
Alert Management	Alert priorities, false positives, true positives, escalation procedures.	Splunk	To investigate and prioritize alerts.	Review alerts and classify them by severity.	Explain the difference between false positives and true positives.	Correctly classify security alerts.
Incident Response	Incident response lifecycle: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned.	Microsoft Word	To document incident response procedures.	Create an incident response plan for a ransomware scenario.	Explain the six phases of incident response.	Develop a complete incident response plan.
Digital Evidence Collection	Evidence handling, chain of custody, preserving evidence, documentation.	FTK Imager	To collect digital evidence without altering it.	Create a forensic image of a USB drive or practice image.	Explain the importance of preserving digital evidence.	Acquire a forensic image successfully.
Incident Reporting	Writing security reports, executive summaries, technical findings, recommendations.	Microsoft Word	To produce professional incident reports.	Write an incident report based on a sample scenario.	Explain the components of an incident report.	Produce a professional incident report.
Blue Team Operations	Daily SOC tasks, monitoring, response, reporting, teamwork, communication.	Splunk & Microsoft Sentinel	To perform day-to-day defensive cybersecurity tasks.	Investigate a simulated security incident from beginning to end.	Describe the responsibilities of a Blue Team analyst.	Complete a full incident investigation and present your findings.

---

End-of-Month Project

Project Title

SOC Incident Investigation

Objectives

• Monitor security events.

• Detect suspicious activity.

• Analyze system logs.

• Investigate alerts.

• Respond to a simulated cyber incident.

• Produce a professional incident response report.

Tools

• Splunk

• Microsoft Sentinel (Lab)

• FTK Imager

• Microsoft Word

---

Real-Life Projects

Project 1

Create an Incident Response Plan
Develop an incident response plan for a small business covering:

• Malware infection

• Phishing attack

• Lost or stolen laptop

• Ransomware incident

• Data breach

• Recovery procedures

---

Project 2

Windows Security Log Review
Using a Windows computer that you own or have permission to use:

• Review Event Viewer logs.

• Identify failed login attempts.

• Identify successful logins.

• Check for system errors and warnings.

• Write a report summarizing your findings.

---

End-of-Month Assessment

Theory Assessment (30%)

• 20 Multiple Choice Questions

• 10 Short Answer Questions

• SIEM case studies

• Incident response scenarios

---

Practical Assessment (40%)

Students must:

• Import logs into Splunk.

• Search for failed login attempts.

• Identify suspicious events.

• Create a simple SIEM dashboard.

• Research Indicators of Compromise (IOCs).

• Write an incident response plan.

• Produce an incident investigation report.

---

Project Assessment (20%)

Students will be assessed on:

• Quality of incident investigation

• Accuracy of log analysis

• Completeness of incident response plan

• Professional reporting

• Ability to explain findings

---

Class Participation (10%)

• Attendance

• Lab participation

• Homework

• Group discussions

• Practical demonstrations

• Incident investigation presentation