Project 1
Build a SOC dashboard
Ingest logs from Windows, Linux and a firewall into Wazuh and build a monitoring dashboard with working alerts.
- Wazuh
- Dashboards
- Alerting
Security Track · Blue Team
SOC Analyst Course for the Blue Team
Become the analyst who spots the intrusion in a wall of alerts. Three months on SIEM, log analysis, threat detection and incident response, taught on a live SOC lab by analysts who work real shifts.
Work a simulated SOC shift
Map alerts to MITRE ATT&CK
Placement support included
Program snapshot
Admissions open- Duration
- 3 months · 130 guided hours
- Mode
- Online live or classroom, Aligarh
- Level
- Beginner to L1/L2 analyst
- Schedule
- Evening & weekend batches
- Certificate
- Cyber Warrior Certified SOC Analyst
- Tools
- Splunk, Wazuh, ELK, Suricata
Fees from
₹32,000 incl. GST, full program
What a SOC analyst course teaches
A SOC (Security Operations Centre) analyst course trains you to monitor an organisation for attacks and respond when one happens. You learn to collect and read logs, use a SIEM to search and correlate events, write detection rules, triage alerts, separate real intrusions from noise, and follow an incident response playbook. It is the defensive, blue-team counterpart to ethical hacking.
130h
Guided Hours
500+
Alerts You Will Triage
4.9/5
Rating, 153 Reviews
100%
Live SOC Lab
Who this SOC analyst course is for
The SOC is the most common entry point into a security career, and this course is built for people aiming at that first shift.
Freshers targeting their first security job
Graduates who want a clear, in-demand entry role. SOC L1 is where most security careers begin, and it hires on demonstrated triage skill.
IT support and helpdesk staff
People already comfortable with tickets and systems who want to move into a monitoring role that pays more.
Network and system administrators
Admins who understand infrastructure and want to specialise in detecting and responding to attacks against it.
Security learners wanting defence depth
Cyber security or ethical hacking learners who want to master the blue-team side that most jobs actually need.
Learning outcomes
What you can do after this SOC analyst course
Every outcome is a task an L1 or L2 analyst performs on shift, and every one is graded on the SOC lab.
01
Triage and prioritise alerts
Work a queue of alerts, separate false positives from real threats and escalate correctly under time pressure.
02
Investigate with a SIEM
Search, filter and correlate events in Splunk and Wazuh to reconstruct what an attacker did.
03
Map activity to MITRE ATT&CK
Identify the tactics and techniques behind an alert and use them to hunt for related activity.
04
Write detection rules
Author Sigma and SIEM rules that catch real behaviour without drowning the team in noise.
05
Follow incident response playbooks
Execute containment and escalation steps for phishing, malware and ransomware scenarios.
06
Document and hand off cleanly
Write incident tickets and shift notes that let the next analyst pick up without starting cold.
Syllabus
Request the detailed syllabus PDF
SOC analyst course syllabus
Seven modules over three months, built around a live SOC lab. The course ends with a simulated shift against a red-team exercise.
7
Modules
130
Guided hours
What a SOC does, how tiers and shifts work, and the networking and OS knowledge every alert depends on.
- SOC structure, tiers and roles
- Shift workflow and handover
- Networking refresher for defenders
- Windows and Linux event basics
- Attack lifecycle and kill chain
- CIA triad and risk
- SOC metrics: MTTD, MTTR
- Careers and certifications map
Module outcome: You can explain the full alert-to-escalation workflow of a SOC.
Where telemetry comes from and how it reaches the SIEM: syslog, Windows events, endpoints, firewalls and cloud.
- Syslog and log formats
- Windows Event Log deep dive
- Sysmon configuration
- Firewall, proxy and DNS logs
- Cloud logs: CloudTrail, VPC flow
- Log forwarding and agents
- Parsing and normalisation
- Log retention and integrity
Module outcome: You configure Sysmon and ship logs into a SIEM.
The analyst's primary tool: searching, correlating and dashboarding events to find the story in the data.
- Splunk search processing language
- Building searches and correlations
- Dashboards and alerting
- Wazuh and ELK stack
- Index and data models
- Enrichment and lookups
- Tuning to reduce noise
- Saved searches and scheduling
Module outcome: You build a working dashboard and three correlation searches.
Turning attacker behaviour into detections you can trust, using the ATT&CK framework as the map.
- MITRE ATT&CK tactics and techniques
- Detection engineering basics
- Writing Sigma rules
- Behaviour vs signature detection
- Threat intelligence and IOCs
- Detecting common techniques
- Coverage gaps and prioritisation
- Purple team collaboration
Module outcome: You write Sigma rules for five ATT&CK techniques and test them.
The core skill: working a real queue, deciding what is real, and investigating end to end.
- Triage methodology
- False positive analysis and tuning
- Investigating phishing alerts
- Malware and beaconing detection
- Lateral movement indicators
- Pivoting across data sources
- Building an investigation timeline
- Escalation criteria
Module outcome: You triage a batch of alerts and escalate the real intrusions correctly.
What happens after escalation: containment, evidence, and the playbooks that keep responses consistent.
- NIST incident response lifecycle
- Phishing and BEC playbooks
- Ransomware response
- Containment and isolation
- Evidence handling basics
- Communication and reporting
- Post-incident review
- Threat hunting introduction
Module outcome: You run a phishing incident end to end using a playbook.
A simulated live shift against a red-team exercise, plus preparation for SOC certifications and interviews.
- Capstone: work a full simulated shift
- Detect and respond to a live attack
- Write the incident report
- Present findings to the SOC lead
- CySA+ and Blue Team Level 1 prep
- Resume and portfolio review
- SOC interview practice
- Placement pipeline onboarding
Module outcome: You complete a graded SOC shift and incident report.
The blue-team toolkit
A full SOC lab in your browser from week one. Everything is open-source or lab-licensed and included in the fee.
SIEM & Analytics
- Splunk
- Wazuh
- Elastic (ELK)
- Kibana
Endpoint & Logs
- Sysmon
- Windows Event Log
- Auditd
- OSQuery
Network Detection
- Suricata
- Zeek
- Snort
- Wireshark
Detection & Threat Intel
- MITRE ATT&CK
- Sigma
- MISP
- TheHive
- VirusTotal
Portfolio work
SOC projects for your portfolio
Deliverables that show a hiring SOC manager you can do the job on day one.
Project 2
Detection rule pack
Write and test a pack of Sigma rules covering ten MITRE ATT&CK techniques, with documented false-positive tuning.
- Sigma
- MITRE
- Detection
Project 3
Phishing investigation
Investigate a phishing campaign from email headers to payload and produce an incident report.
- IR
- Phishing
- Reporting
Project 4
Malware beacon hunt
Detect and reconstruct a C2 beacon in network and endpoint logs and map it to ATT&CK.
- Threat hunting
- Zeek
- C2
Project 5
Ransomware response runbook
Execute a ransomware containment scenario against a playbook and write the post-incident review.
- Playbooks
- Containment
- Review
Project 6
Capstone live shift
Work a simulated shift against a red-team exercise, detect the intrusion in real time and escalate it.
- SOC shift
- Triage
- Escalation
How the SOC analyst course runs
Six steps, the first two free, from enquiry to a graded SOC shift.
-
1
Book a counselling call
Twenty minutes with a working analyst who tells you whether SOC is the right entry point for your background.
-
2
Complete the readiness check
A short check on networking and logic that sets your week-one foundation sessions.
-
3
Set up the SOC lab
We give you a browser-based SOC lab with SIEM, endpoints and a network to monitor from day one.
-
4
Learn detection, practise triage
Live sessions plus graded labs where you build detections and work real alert queues every fortnight.
-
5
Run the capstone shift
A simulated live shift against a red-team exercise, graded on whether you catch and escalate the intrusion.
-
6
Certification and placement prep
CySA+ and BTL1 preparation, portfolio review, mock interviews and referrals into SOC roles.
Career outcomes
SOC analyst jobs and salaries
SOC analyst is the highest-volume entry role in security hiring in India, and demand is steady because monitoring never stops.
| Role | Typical salary (India) | What the job involves |
|---|---|---|
| SOC Analyst L1 | ₹3 to 5.5 LPA | Monitor alerts, perform first triage and escalate. The direct target role for this course. |
| SOC Analyst L2 | ₹5 to 9 LPA | Investigate escalated incidents, tune detections and hunt for threats. Reached in 12 to 24 months. |
| Incident Responder | ₹6 to 12 LPA | Lead containment and investigation of confirmed incidents. |
| Threat Hunter | ₹7 to 14 LPA | Proactively search for undetected intrusions across the environment. |
| Detection Engineer | ₹8 to 16 LPA | Design and maintain the detection content the whole SOC relies on. |
| SIEM / Security Engineer | ₹6 to 13 LPA | Build and run the SIEM and logging pipeline itself. |
Where graduates of this track get hired
- Managed security providers
- IT services majors
- Banks & fintech
- Telecom
- Healthcare
- E-commerce
- Government SOCs
- Cyber Warrior operations
Salary bands are indicative for India in 2026 and vary by city and employer. Many SOCs run rotating shifts including nights; we cover what that means on the counselling call. Placement support is active help until hired, not a guarantee.
Placement support includes
- Resume, LinkedIn and GitHub portfolio review
- Mock technical and HR interviews with our engineers
- Referrals into our client and partner network
- Priority consideration for the Cyber Warrior internship
Choosing a format
The SOC lab and syllabus are identical across formats.
| Criterion | Online live | Classroom, Aligarh | Self-paced | Corporate batch |
|---|---|---|---|---|
| Live sessions per week | 3, evening or weekend | 3 at our Aligarh centre | Recorded only | Scheduled with team |
| SOC lab | Browser-based lab | Lab + centre network | Browser-based lab | Your SIEM or ours |
| Doubt clearing | Saturday clinic + chat | Daily, in person | Weekly office hours | Dedicated trainer |
| Graded labs & capstone | Yes | Yes | Self-submitted | Tailored |
| Certification prep | Included | Included | Included | Optional |
| Best for | Anyone in India | Aligarh students | Budget self-starters | IT & security teams |
| Typical duration | 3 months | 3 months | Up to 6 months access | 2 to 4 weeks |
Teams upskilling an existing SOC use corporate training.
Fees & batches
SOC analyst course fees
One fee covering the SOC lab, tooling, certification preparation and placement support.
Next batches
New batches on the first Monday of every month, evening and weekend options.
Pay in instalments
Pay in 3 monthly instalments at no extra cost; the first confirms your seat.
Scholarships
Up to 25% merit scholarship based on the readiness check.
SOC Analyst Course · full program
₹32,000incl. GST, full program
Everything included
- 130 hours of live, practitioner-led sessions
- Recordings for 12 months
- Browser-based SOC lab with SIEM
- Splunk and Wazuh lab environments
- Graded capstone SOC shift
- CySA+ and BTL1 exam preparation
- Cyber Warrior Certified SOC Analyst certificate
- Placement support until hired
- Detection-engineering community access
Fees are indicative for the current cycle. Refunds follow our refund policy: full refund before the second live session.
Why train as a SOC analyst with Cyber Warrior
Our own operations team monitors client environments. The alerts you learn to triage are modelled on ones they handle for security clients.
Taught by working analysts
Instructors who work real shifts, not trainers reading a manual.
A live SOC lab, not screenshots
You investigate real telemetry and work real alert queues from week one.
Detection engineering, not just clicking
You write the rules that catch attacks, which is what separates an L2 from an L1.
A real referral network
Our client and partner SOCs are where our placement referrals go.
Aligarh classroom, India-wide online
In-person lab days in Aligarh and live online batches nationwide.
Small batches, real feedback
Capped at 25 so your investigations get reviewed individually.
Programs learners pair with this one
Every track in the Cyber Warrior programs catalogue shares the same faculty and project standard, so stacking two is common.
6 months
Cyber Security Course
Job-ready security training with placement support.
Explore program
4 months
Ethical Hacking Course
Offensive security, CEH-aligned, on real lab targets.
Explore program
4 months
AWS Cloud Computing Course
Cloud Practitioner to Solutions Architect on live AWS accounts.
Explore program
4 months
DevOps Course
Linux, Docker, Kubernetes, CI/CD and Terraform in production.
Explore program
3 months
Python Course
Python programming from first script to automation and APIs.
Explore program
2 to 6 months
Internship Program
Paid and certificate internships on live agency projects.
Explore program
Clear answers
SOC Analyst Course questions
The questions every applicant asks on the first counselling call.
It trains you to work in a Security Operations Centre: monitoring an organisation for attacks using a SIEM, triaging alerts, detecting threats and following incident response playbooks. This course is three months and built around a live SOC lab.
The full program fee is ₹32,000 including GST, payable in 3 monthly instalments at no extra cost. It covers the SOC lab, SIEM environments, certification preparation and placement support. Merit scholarships of up to 25% are available.
Three months, about 130 guided hours, with three live sessions a week plus graded labs. Working professionals spend around 8 hours a week.
No. SOC L1 is designed as an entry role. The course builds the networking and log knowledge from scratch. IT support and helpdesk experience helps but is not required.
Primarily Splunk and Wazuh, with the ELK stack, plus network detection with Suricata and Zeek and threat intelligence with MISP and TheHive. All are provided in the lab.
Yes. The online live format uses the same SOC lab, syllabus and instructors as the Aligarh classroom, with recorded sessions for revision.
You receive the Cyber Warrior Certified SOC Analyst certificate, and the final module prepares you for CompTIA CySA+ and Blue Team Level 1 (BTL1), which are booked separately.
Many SOCs run 24/7 with rotating shifts, so nights can be part of an L1 role. Pay and shift structure vary by employer, and we explain the trade-offs honestly on the counselling call.
Ethical hacking is offensive: breaking in. The SOC analyst course is defensive: detecting and responding to attacks. Most security jobs are defensive, and many analysts take both to understand each side.
Start on the blue team
Book a call with a working SOC analyst. We will tell you whether the SOC analyst course is the right entry point for you and when the next lab batch starts.
Prefer WhatsApp or email? Contact the admissions team and we reply in under 3 minutes during working hours.