Security · intermediate
SOC Analyst: SIEM, Splunk & Threat Detection
Master the core skills of a modern Security Operations Center (SOC) analyst. From understanding the MITRE ATT&CK framework and SIEM architecture to writing Splunk SPL queries, triaging alerts, and proactively hunting for threats, this hands-on course prepares you to detect and respond to real-world cyber incidents using industry-standard tooling.
- 11 hours
- 21 lessons
- 5 modules
- updated September 2026
Try it before you sign up
Read a full lesson and answer 3 questions from the Module 1 quiz. No account needed.
Inside the SOC: Structure, Tiers, and the Incident Lifecycle
5 modules, 21 lessons
Module 1 is free — lessons, hands-on walkthrough and quiz.
- readInside the SOC: Structure, Tiers, and the Incident Lifecycle25 min
- videoMITRE ATT&CK Explained: Tactics, Techniques, and Practical Use12 min
- hands-onHands-On: Exploring MITRE ATT&CK and Mapping Log Events20 min
- quizModule 1 Quiz: SOC Fundamentals & Threat Landscape10 min
Built by the CloudaQube team
No celebrity instructor — here is exactly what goes into the course instead.
- 01 6 guided hands-on walkthroughs you run in a real environment.
- 02 5 module quizzes — every answer comes with an explanation.
- 03 Last updated September 2026.
- 04 Any module can become a hands-on lab in Labs Studio.
What you'll be able to do
- 01 Explain the structure and mission of a Security Operations Center and its analyst tiers
- 02 Map attacker behaviours to MITRE ATT&CK tactics, techniques, and sub-techniques
- 03 Describe SIEM architecture including data ingestion, normalisation, indexing, and search
- 04 Configure Splunk inputs, write SPL queries, and build dashboards and scheduled alerts
- 05 Apply correlation rules to detect threats, triage alerts, and escalate genuine incidents
- 06 Conduct proactive threat hunts using hypothesis-driven SPL searches and threat intelligence
- 07 Automate repetitive response tasks using SOAR playbooks and understand their role in a modern SOC
- — Basic networking concepts (TCP/IP, DNS, HTTP)
- — Familiarity with the Linux command line
- — Understanding of common cybersecurity concepts (firewalls, IDS, malware)
- — No prior Splunk or SIEM experience required
Before you start
How long does it take?
About 11 hours of lessons, videos and hands-on walkthroughs across 5 modules.
What’s free?
Module 1 in full — lessons, hands-on walkthrough and quiz — with no card required. Any paid plan (from $8.99/mo) unlocks all 5 modules, and starts with a 14-day free trial.
Start the course with Module 1 free.
No card required. Unlock every module from $8.99/mo when you’re ready.