Security Operations & Defense
Run day-to-day defense like a SOC analyst: logging and SIEM hunting, IDS alerts, incident response, triage, forensics, vulnerability management, hardening, cloud posture and MITRE ATT&CK.
Leads to: Cybersecurity Engineer, IT Support Specialist
Before you start
This course builds on Cybersecurity Fundamentals and Linux Administration. Take them first if you are new to the topic.
About this course
This mid-level course takes you from security fundamentals to the daily work of a security operations team. It builds on Cybersecurity Fundamentals and Linux Administration, and it is the last course on the Cybersecurity Engineer path. The first module is detection: choosing the logs that matter, hunting through them with SIEM-style queries (you write SQL against an authentication log), and running Suricata on your own VM to read a real IDS alert. The second module is incident response: the NIST lifecycle, triaging a queue of alerts, and first-responder forensics with evidence handling and a timeline. The third module covers hardening and vulnerability management: prioritising findings by CVSS, active exploitation and exposure, applying a CIS Benchmark item safely, and fixing a public bucket and an open port in your own free-tier cloud account. The last module looks from the attacker's side: mapping incidents to MITRE ATT&CK, planning a scoped penetration test in a legal home lab, and planning CySA+ or a similar certification. All hands-on work uses virtual machines and accounts you own, open-source tools such as Suricata, Wazuh and Security Onion, or free training platforms that authorise you. Never test systems without the owner's written permission. Mid-level roles also expect real work experience; this course helps you build and show it.
Course content
Module 1
Detection
3 lessons · 2h 4mChoose the logs that matter, hunt through them with SIEM queries, and read network IDS alerts.
- 30mSecurity loggingReading
Pick the logs that matter: authentication, process, network and cloud audit events, and the Windows and Linux entries defenders read most.
- 39mSIEM and queriesReading
See what a SIEM does and hunt through authentication logs with filter, group, threshold and correlation queries.
- 55mNetwork detectionReading
Learn how Snort and Suricata detect attacks, read a rule, and work through an IDS alert step by step.
Module 2
Incident Response
3 lessons · 2h 3mRun incidents through the NIST lifecycle, triage alerts quickly and consistently, and preserve evidence with a clear timeline.
- 30mThe IR lifecycleReading
Walk an incident through the NIST phases: preparation, detection and analysis, containment, eradication and recovery, and lessons learned.
- 39mAlert triageReading
Triage alerts like a SOC analyst: check the rule, the data and the context, classify, prioritise and write a clear note.
- 54mForensics basicsReading
Preserve evidence in order of volatility, prove integrity with hashes and chain of custody, and build a UTC timeline.
Module 3
Hardening and Vulnerability Management
3 lessons · 2h 4mPrioritise vulnerabilities by real risk, harden systems with CIS Benchmarks, and fix common cloud misconfigurations.
- 29mVulnerability managementReading
Read CVE, CWE and CVSS, then prioritise findings by exploitation evidence, exposure and asset value rather than score alone.
- 50mSystem hardeningReading
Use CIS Benchmarks to audit and apply hardening safely, starting with disabling SSH root login on a Linux VM.
- 45mCloud security postureReading
Understand shared responsibility and fix the classic cloud misconfigurations: a public storage bucket and an open management port.
Module 4
Thinking Like an Attacker
3 lessons · 1h 55mMap intrusions to MITRE ATT&CK, plan authorised tests in a legal lab, and plan your next certification.
- 30mMITRE ATT&CKReading
Use MITRE ATT&CK tactics and techniques to describe an intrusion step by step and find detection gaps.
- 45mPentest methodologyReading
Plan a scoped, authorised penetration test in your own lab, from rules of engagement to a defender-focused report.
- 40mMid-level certificationsReading
Plan your route to a mid-level security role: CySA+ or an alternative, CISSP's experience rule, and building real experience.