Browse CTFs New CTF Sign in
Back to Learning Paths
Cyber Security Operations Analyst
Associate Wave 1 Draft

Cyber Security Operations Analyst

45.0h estimated 3 Courses

This associate-level path prepares learners to work in a Security Operations Center. It teaches how alerts are produced, how logs should be interpreted, how network and endpoint evidence are correlated, and how to escalate findings in a clear analyst report. The emphasis is on disciplined triage: identify what happened, decide whether it matters, preserve useful evidence, and communicate the next action.

Sign in to enroll

SOC Fundamentals & Alert Triage

4 cards

SOC Architecture, Analyst Tiers & the Alert Lifecycle

soc_operations Difficulty 1–2 45 min

MITRE ATT&CK: Mapping Events to Tactics & Techniques

soc_operations Difficulty 1–2 40 min

Windows Event Log Investigation: Authentication & Persistence Detection

log_analysis_siem Difficulty 2–3 60 min

SIEM Investigation: Detecting Ransomware Pre-Deployment Activity

log_analysis_siem Difficulty 2–4 55 min

Log Analysis & Detection Engineering

4 cards

Network Detection: C2 Beaconing & DNS Exfiltration in SIEM

network_forensics_pcap Difficulty 2–3 55 min

SIEM Investigation: Web Application Attack Chain Detection

log_analysis_siem Difficulty 2–3 55 min

Detection Engineering: Writing and Tuning Sigma Rules

detection_engineering Difficulty 1–3 50 min

Network Forensics: PCAP Analysis for SOC Investigations

network_forensics_pcap Difficulty 1–2 60 min

Network Evidence & Threat Enrichment

3 cards

SIEM Investigation: DNS Exfiltration Trace

log_analysis_siem Difficulty 2–3 55 min

IOC Enrichment & Applied Threat Intelligence for SOC Analysts

soc_operations Difficulty 1–2 50 min

SOC Capstone: End-to-End Investigation from Alert to Report

soc_operations Difficulty 2–4 70 min
🏅

CTFFactory Cyber Security Operations Analyst — Associate

Associate credential — awarded upon completion