Planning

Weeks Topics Name

1st week Introduction SOC

2nd week Basic Security ( Linux & Networking )

3rd week SOC OR SIEM Implement

4th Week SOC Analyst life scenario

Introduction to
SOC

Boni Yeamin
Cyber Security Analyst
Cybersecurity Audit & Resilient Enterprise
WHO I AM ?

❖ Cyber Security Analyst

❖ SOC Builder
❖ CTF Player
❖ Lover
❖ Brother
Agenda

❏ Introduction to SOC
❏ SOC Types
❏ Different Roles in SOC
❏ SOC Analyst and Their Responsibilities
❏ SIEM and Analyst Relationship
❏ Log types & Management
❏ EDR - XDR
❏ SOC Tools
❏ SIEM Tools
Introduction

What is Soc ?

The function of the security operations center

(SOC) is to monitor, prevent, detect, investigate,
and respond to cyber threats around the clock.
SOC teams are charged with monitoring and
protecting the organization's assets including
intellectual property, personnel data, business
systems, and brand integrity.
What is soc Analyst

A SOC (Security Operations Center) Analyst

is a cybersecurity professional responsible for
monitoring, analyzing, and responding to
security threats to an organization's
information systems and networks.
SOC Types

Types Of SOC Models

❏ In-house SOC
❏ In-house Virtual SOC
❏ Co-Managed SOC
❏ Outsourced Virtual SOC
Different Roles in SOC

❏ Tier 1. Security Analyst ,Incident

Responder ,Security Operator
❏ Tier 2. Security Investigator
❏ Tier 3. Advanced Security Analyst
,Threat Hunter
❏ SOC manager
❏ Security Engineers/Architects
Roles & Responsibilities
SIEM

Security Information and Event

Management (SIEM) is a security solution
that collects, analyzes, and correlates
security-related data from multiple sources in
real-time. The main objectives of SIEM are to
provide centralized visibility into an
organization's security posture, detect
security incidents, and simplify incident
response.
SIEM use case
SOC and SIEM Analyst Relationship

SOC= security operations center

SIM =security information Management

SEM=security event Management

Log types & Management

❏ System logs
❏ Application logs
❏ Security logs
❏ Audit logs
❏ Network logs
❏ Access logs
❏ Performance logs
EDR - Endpoint Detection and Response

Key features of EDR solutions include:

❏ Endpoint monitoring: Continuously monitor

endpoint activity to detect and respond to security
incidents.
❏ Threat detection: Use machine learning algorithms
and threat intelligence to detect known and unknown
threats.
❏ Incident response: Automate incident response
procedures to minimize the impact of security
incidents.
❏ Forensics: Provide detailed forensic information
about security incidents to aid in investigations and
post-incident analysis.
❏ Compliance: Help organizations comply with security
regulations and standards.
10 SOC tools
Top SIEM Tools for SOC Analysts

❏ Splunk
❏ LogRhythm
❏ AlienVault OSSIM
❏ AlienVault OSSIM
❏ wazuh
How to become a soc Analyst
Learn SOC

Find job Create portfolio

Blue team certification Experience

Questions and Answers