for monitoring and analyzing security-related data from a variety of sources, such as network devices, security tools, and applications. The goal of a SOC is to identify, analyze, and respond to security incidents in a timely and effective manner.

2. Planning
Weeks Topics Name
1st week Introduction SOC
2nd week Basic Security ( Linux & Networking )
3rd week SOC OR SIEM Implement
4th Week SOC Analyst life scenario

3. Introduction to
SOC
Boni Yeamin
Cyber Security Analyst
Cybersecurity Audit & Resilient Enterprise

4. WHO I AM ?
❖ Cyber Security Analyst
❖ SOC Builder
❖ CTF Player
❖ Lover
❖ Brother

5. Agenda
❏ Introduction to SOC
❏ SOC Types
❏ Different Roles in SOC
❏ SOC Analyst and Their Responsibilities
❏ SIEM and Analyst Relationship
❏ Log types & Management
❏ EDR - XDR
❏ SOC Tools
❏ SIEM Tools

6. Introduction
What is Soc ?
The function of the security operations center
(SOC) is to monitor, prevent, detect, investigate,
and respond to cyber threats around the clock.
SOC teams are charged with monitoring and
protecting the organization's assets including
intellectual property, personnel data, business
systems, and brand integrity.

7. What is soc Analyst
A SOC (Security Operations Center) Analyst
is a cybersecurity professional responsible for
monitoring, analyzing, and responding to
security threats to an organization's
information systems and networks.

8. SOC Types
Types Of SOC Models
❏ In-house SOC
❏ In-house Virtual SOC
❏ Co-Managed SOC
❏ Outsourced Virtual SOC

9. Different Roles in SOC
❏ Tier 1. Security Analyst ,Incident
Responder ,Security Operator
❏ Tier 2. Security Investigator
❏ Tier 3. Advanced Security Analyst
,Threat Hunter
❏ SOC manager
❏ Security Engineers/Architects

10. Roles & Responsibilities

11. SIEM
Security Information and Event
Management (SIEM) is a security solution
that collects, analyzes, and correlates
security-related data from multiple sources in
real-time. The main objectives of SIEM are to
provide centralized visibility into an
organization's security posture, detect
security incidents, and simplify incident
response.

12. SIEM use case

13. SOC and SIEM Analyst Relationship
SOC= security operations center
SIM =security information Management
SEM=security event Management

14. Log types & Management
❏ System logs
❏ Application logs
❏ Security logs
❏ Audit logs
❏ Network logs
❏ Access logs
❏ Performance logs

15. EDR - Endpoint Detection and Response
Key features of EDR solutions include:
❏ Endpoint monitoring: Continuously monitor endpoint
activity to detect and respond to security incidents.
❏ Threat detection: Use machine learning algorithms and
threat intelligence to detect known and unknown threats.
❏ Incident response: Automate incident response procedures
to minimize the impact of security incidents.
❏ Forensics: Provide detailed forensic information about
security incidents to aid in investigations and post-incident
analysis.
❏ Compliance: Help organizations comply with security
regulations and standards.

16. SOAR (Security Orchestration Automation and
Response)

17. 10 SOC tools

18. Top SIEM Tools for SOC Analysts
❏ Splunk
❏ LogRhythm
❏ AlienVault OSSIM
❏ AlienVault OSSIM
❏ wazuh

19. How to become a soc Analyst
Learn SOC
Find job
Experience
Blue team certification
Create portfolio

20. Questions and Answers