Overview

The Certified SOC Analyst (CSA) program is the first step to joining a security operations center (SOC). It is engineered for current and aspiring Tier I and Tier II SOC analysts to achieve proficiency in performing entry-level and intermediate-level operations.

CSA is a training and credentialing program that helps the candidate acquire trending and in-demand technical skills through instruction by some of the most experienced trainers in the industry. The program focuses on creating new career opportunities through extensive, meticulous knowledge with enhanced level capabilities for dynamically contributing to a SOC team. Being an intense 3-day program, it thoroughly covers the fundamentals of SOC operations, before relaying the knowledge of log management and correlation, SIEM deployment, advanced incident detection, and incident response. Additionally, the candidate will learn to manage various SOC processes and collaborate with CSIRT at the time of need.

Read more

Prerequisites

The CSA program require the candidate to have one year of work experience in the Network Admin/Security domain.

Read more

Delegates will learn how to

  • Gain Knowledge of SOC processes, procedures, technologies, and workflows.
  • Gain basic understanding and in-depth knowledge of security threats, attacks, vulnerabilities, attacker’s behaviors, cyber kill chain, etc.
  • Able to recognise attacker tools, tactics, and procedures to identify indicators of compromise (IOCs) that can be utilised during active and future investigations.
  • Able to monitor and analyse logs and alerts from a variety of different technologies across multiple platforms (IDS/IPS, end-point protection, servers and workstations).
  • Gain knowledge of Centralised Log Management (CLM) process.
  • Able to perform Security events and log collection, monitoring, and analysis.
  • Gain experience and extensive knowledge of Security Information and Event Management.
  • Gain knowledge on administering SIEM solutions (Splunk/AlienVault/OSSIM/ELK).
  • Understand the architecture, implementation and fine tuning of SIEM solutions (Splunk/AlienVault/OSSIM/ELK).
  • Gain hands-on experience on SIEM use case development process.
  • Able to develop threat cases (correlation rules), create reports, etc.
  • Learn use cases that are widely used across the SIEM deployment.
  • Plan, organise, and perform threat monitoring and analysis in the enterprise.
  • Able to monitor emerging threat patterns and perform security threat analysis.
  • Gain hands-on experience in alert triaging process.
  • Able to escalate incidents to appropriate teams for additional assistance.
  • Able to prepare briefings and reports of analysis methodology and results.
  • Gain knowledge of integrating threat intelligence into SIEM for enhanced incident detection and response.
  • Able to make use of varied, disparate, constantly changing threat information.
  • Gain knowledge of Incident Response Process.
  • Gain understating of SOC and IRT collaboration for better incident response.
Read more

Course Outline

1. Security Operations and Management

  • Understand the SOC Fundamentals
  • Discuss the Components of SOC: People, Processes and Technology
  • Understand the Implementation of SOC

2. Understanding Cyber Threats, IoCs, and Attack Methodology

  • Describe the term Cyber Threats and Attacks
  • Understand the Network Level Attacks
  • Understand the Host Level Attacks
  • Understand the Application Level Attacks
  • Understand the Indicators of Compromise (IoCs)
  • Discuss the Attacker’s Hacking Methodology

3. Incidents, Events, and Logging Understand the Fundamentals of Incidents, Events, and Logging

  • Explain the Concepts of Local Logging
  • Explain the Concepts of Centralised Logging

4. Incident Detection with

  • Security Information and Event Management (SIEM)
  • Understand the Basic Concepts of Security
  • Information and Event Management (SIEM)
  • Discuss the Different SIEM Solutions
  • Understand the SIEM Deployment
  • Learn Different Use Case Examples for Application Level Incident Detection
  • Learn Different Use Case Examples for Insider Incident Detection
  • Learn Different Use Case Examples for Network Level Incident Detection
  • Learn Different Use Case Examples for Host Level Incident Detection
  • Learn Different Use Case Examples for Compliance
  • Understand the Concept of Handling Alert Triaging and Analysis

5. Enhanced Incident Detection with Threat Intelligence

  • Learn Fundamental Concepts on Threat Intelligence 8%
  • Learn Different Types of Threat Intelligence
  • Understand How Threat Intelligence Strategy is Developed
  • Learn Different Threat Intelligence Sources from which Intelligence can be Obtained
  • Learn Different Threat Intelligence Platform (TIP)
  • Understand the Need of Threat Intelligence-driven SOC

6. Incident Response Understand the Fundamental Concepts of Incident Response

  • Learn Various Phases in Incident Response Process
  • Learn How to Respond to Network Security Incidents
  • Learn How to Respond to Application Security Incidents
  • Learn How to Respond to Email Security Incidents
  • Learn How to Respond to Insider Incidents
  • Learn How to Respond to Malware Incidents

Exam Information

The CSA exam is taken post course. Delegates will recieve an exam voucher as part of the course. The exam is designed to test and validate a candidate’s comprehensive understanding of the jobs tasks required as a SOC analyst. Thereby validating their comprehensive understanding of a complete SOC workflow.

  • Exam Title Certified SOC Analyst
  • Number of Questions 100
  • Duration 3 hours
  • Test Format Multiple Choice
  • Passing Score 70%
Read more

Why choose QA

Special Notices

You will receive your Pearson Vue exam voucher in your course fee, and will need to arrange this at Pearson Vue testing facility.
Once you have completed the course, please submit the course evaluation via the ASPEN portal for your exam voucher to be released.
The EC Council exam is taken post-course, and EC Council recommend additional post-course study in order to fully prepare for it.
Your 6 month access to the iLabs platform will commence once you complete the course.
Please note - Commencing January 1st, 2019, EC-Council will no longer ship out physical certificates. EC-Council certified members can continue to download their e-Certificates from the ASPEN portal. Certified members who still wish to receive a physical certificate may request one via 'certsupport@eccouncil.org'. Printed certificate requests in the UK will cost $75 ($50 for the US).

Frequently asked questions

See all of our FAQs

How can I create an account on myQA.com?

There are a number of ways to create an account. If you are a self-funder, simply select the "Create account" option on the login page.

If you have been booked onto a course by your company, you will receive a confirmation email. From this email, select "Sign into myQA" and you will be taken to the "Create account" page. Complete all of the details and select "Create account".

If you have the booking number you can also go here and select the "I have a booking number" option. Enter the booking reference and your surname. If the details match, you will be taken to the "Create account" page from where you can enter your details and confirm your account.

Find more answers to frequently asked questions in our FAQs: Bookings & Cancellations page.

How do QA’s virtual classroom courses work?

Our virtual classroom courses allow you to access award-winning classroom training, without leaving your home or office. Our learning professionals are specially trained on how to interact with remote attendees and our remote labs ensure all participants can take part in hands-on exercises wherever they are.

We use the WebEx video conferencing platform by Cisco. Before you book, check that you meet the WebEx system requirements and run a test meeting (more details in the link below) to ensure the software is compatible with your firewall settings. If it doesn’t work, try adjusting your settings or contact your IT department about permitting the website.

Learn more about our Virtual Classrooms.

How do QA’s online courses work?

QA online courses, also commonly known as distance learning courses or elearning courses, take the form of interactive software designed for individual learning, but you will also have access to full support from our subject-matter experts for the duration of your course. When you book a QA online learning course you will receive immediate access to it through our e-learning platform and you can start to learn straight away, from any compatible device. Access to the online learning platform is valid for one year from the booking date.

All courses are built around case studies and presented in an engaging format, which includes storytelling elements, video, audio and humour. Every case study is supported by sample documents and a collection of Knowledge Nuggets that provide more in-depth detail on the wider processes.

Learn more about QA’s online courses.

When will I receive my joining instructions?

Joining instructions for QA courses are sent two weeks prior to the course start date, or immediately if the booking is confirmed within this timeframe. For course bookings made via QA but delivered by a third-party supplier, joining instructions are sent to attendees prior to the training course, but timescales vary depending on each supplier’s terms. Read more FAQs.

When will I receive my certificate?

Certificates of Achievement are issued at the end the course, either as a hard copy or via email. Read more here.

Contact Us

Please contact us for more information