SOC Operations

Learning Objectives

• Ingest and query logs using a SIEM like Splunk or ELK.
• Correlate disparate log events to identify an attack chain.
• Triage security alerts and filter false positives.

Core Topics

Practical Exercise

Import a dataset of web server logs into an ELK stack or Splunk instance and write queries to identify a brute-force SSH attack based on failed logins.

Recommended Learning Resources