EC-Council Certified SOC Analyst (C|SA)

Price
Net €
VAT €

Price
Price on Request

Duration
3 days

For companies and job seekers:
this course is 100% fundable!

Location

Course Language
English

Training Solutions
Online Live

Request a consultation Add to favorites Print as PDF

Cyberattacks are becoming faster, more targeted, and more complex. Modern Security Operations Centers require professionals who can detect threats early, analyze incidents, and manage security processes effectively. The focus is on real-world attack scenarios, current analysis methods, and a practical look at modern cybersecurity structures.

Key Topics

Security Operations Center (SOC) Processes
Threat Detection and Incident Handling
Log Analysis and Security Monitoring
SIEM Technologies and Alert Evaluation
Network and Endpoint Analysis
Attack Patterns, Indicators of Compromise, and Response Strategies
Cybersecurity Workflows in the Enterprise Environment

Prerequisites
Basic knowledge of networks, IT security, or system administration will help you quickly get up to speed on analysis and monitoring topics.

Target Audience
Suitable for IT security staff, SOC teams, system administrators, network managers, and anyone focused on security monitoring and incident response.

Greater transparency, faster responses, and well-informed security decisions are becoming increasingly important in our digital daily lives. Modern SOC competencies provide a solid foundation for exactly that.

Print as PDF

Module Overview

Security Operations and Management

Understand the principles of security management and the role of security operations.
Explain the Security Operations Center (SOC), its importance, capabilities, and functions.
Describe the SOC workflow and its components: personnel, processes, and technology.
Compare different SOC models and their advantages and disadvantages.
Understand SOC maturity models and the evolution of the SOC.
Identify key performance indicators (KPIs), challenges, and best practices for effective SOC operations.

Cyber threats, indicators of compromise (IoCs), and attack methods

Responsibility for cybersecurity and its implications.
Understanding network-based tactics, techniques, and procedures (TTPs).
Host-based attack TTPs.
Application-based attack TTPs.
Understanding the TTPs of social engineering attacks.
Understanding email-based attack TTPs.
Insider threats and their TTPs.
Identifying indicators of compromise (IoCs).
Understanding attack methods and frameworks.

Log Management

Understanding log management, its importance, and various approaches.
Analyze local logs on Windows, Linux, and Mac.
Analysis of firewall and router logs.
Log analysis for web servers, databases, and email systems.
Implementing centralized logging.

Incident Detection and Triage

Understand the purpose and architecture of SIEM.
Identify different types of SIEM solutions and understand their advantages and disadvantages.
Implement a SIEM solution.
Configure and manage SIEM use cases.
Use SIEM for incident detection.
Use AI to create SIEM rules.
Prioritize and analyze alerts.
Manage visualizations and dashboards.
Create SOC reports

Proactive threat detection

Learn the basics of threat analysis.
Understand the types and strategies of threat analysis.
Identify sources for threat analysis.
Understand platforms for threat analysis.
Learn about information-driven SOCs and their benefits.
Improve incident response using threat analysis.
Understand the importance of threat hunting.
Learn about threat hunting frameworks.
Perform threat hunting using PowerShell, YARA, and tools.

Response to Incidents

Fundamentals of incident response and the IRT.
Understanding the phases of the incident response process.
Handling network security incidents.
Responding to application security incidents.
Email security incidents
Incidents caused by insiders
Malware incidents
Understanding SOC playbooks for incident response.
Use of EDR/XDR in incident response.
Use of SOAR for automated incident response.

Forensic Investigation and Malware Analysis

Introduction to forensic investigation.
Investigation of network incidents.
Analysis of security incidents in applications.
Review of email incidents.
Investigation of insider incidents.
Fundamentals of malware analysis.
Performing static malware analysis.
Dynamic malware analysis.

SOC for Cloud Environments

Introduction to Cloud SOCs
Information about the Azure SOC architecture, Microsoft Sentinel, and related tools.
Introduction to the AWS SOC architecture, AWS Security Hub, and related tools.
Explanations of the Google Cloud SOC architecture, Chronicle, and related tools.

Your training will be 100% funded

Our funding schemes are available exclusively to participants who live or work in Germany. Funding is not available outside Germany.

For career starters, job seekers, career changers, startups, experienced professionals, those looking to advance their careers, specialists, etc.

The QCG program for everyone in the company

Further information

The education voucher for all job seekers

Further information

Frequently Asked Questions

What does a Certified SOC Analyst (C|SA) do?

Analyzing security alerts, detecting attacks, and quickly assessing security incidents—all of which are central to modern Security Operations Centers.

What tools are used in day-to-day SOC operations?

SIEM, threat intelligence, and monitoring tools such as Splunk, QRadar, and Wireshark are among the most common applications.

Why is SOC analyst expertise in such high demand?

Cyberattacks are becoming more complex. Companies need specialists who can detect threats early and respond effectively.

What clinical areas does the certification cover?

Log analysis, incident detection, threat hunting, security monitoring, and handling realistic attack scenarios.

Who is C|SA certification suitable for?

Ideal for IT security, SOC, and network environments with a focus on monitoring, analysis, and incident response.

What benefits does a SOC analyst bring to a company?

Faster response to security incidents, greater transparency, and reduced risks in day-to-day IT operations.

What skills are taught in the Security Operations Center?

Analytical thinking, attack detection, escalation procedures, and structured assessment of security-related incidents.

Why is threat detection becoming increasingly important?

Automated attacks and new threats require continuous monitoring and quick, data-driven decisions.

Do you have any further questions? Please contact us.

Select your nearest center: *

0800 258 258 055

website@newhorizons.de

First Name *

Surname *

Telephone Number *

Postcode *

E-Mail *

I would like to receive funding for further training – I am currently: *

Company Name

Your message

I hereby confirm that I have taken note of the privacy notice. *