Defensive Security
This path teaches you to work on the defensive side: how a SOC operates, how logs are analysed in a SIEM and how the signs of an attack are detected. You will write detection rules, investigate incidents and hunt for hidden activity. Every topic is built on attack traces recreated in the lab.
What you will learn
Key topics
- 01
How a SOC works
SOC structure, analyst roles, alert flow and escalation.
- 02
Logs and telemetry
Windows, Linux and network device logs, and which data lives where.
- 03
Working with a SIEM
Collecting and normalising logs, searching and building dashboards.
- 04
Detection rules
Turning attack techniques into rules and reducing false positives.
- 05
Incident response
Identification, containment, eradication and recovery, and writing the report.
- 06
Threat hunting
Hypothesis-driven searches for hidden activity and turning findings into rules.
Attack and defence
The attacker’s side
- Learn the traces attackers leave during initial access, privilege escalation and lateral movement.
- Analyse logs from attack stages recreated in the lab.
- Map MITRE ATT&CK techniques to concrete log events.
- Understand how attackers try to evade detection.
The defender’s side
- Search a SIEM for suspicious activity and triage alerts.
- Write and test detection rules for specific attack techniques.
- Follow an incident response plan and prepare the report.
- Run hypothesis-driven threat hunts.
Who it is for
- Aspiring SOC analysts.
- System and network administrators moving deeper into defence.
- In-house security teams.
By the end
- Analyse logs in a SIEM and separate real threats from false positives.
- Write, test and tune detection rules.
- Handle an incident from detection to recovery.
- Build and test threat hunting hypotheses.
Other paths
Capture your first flag today
Create a free account and access 700+ hands-on challenges.