SOC Analyst Training — Tehtris Academy
TehtrisAcademyBack to the catalogue

Instructor-led · New SOC analysts

SOC Analyst Training

An intensive one-week path to train new SOC joiners in real operational practice: triage, investigation, DFIR escalation and SLA compliance, from concept to real working conditions.

See the detailed programTraining objectives
Duration
5 days
Level
SOC entry level
Methods
AFEST · Role-play · Case study
Alignment
ENISA ECSF · MITRE ATT&CK
Workshops
9 teaching workshops

Training objectives

Strategic objective

  • Train new SOC joiners in their operational responsibilities from day one

Operational objective

  • Analyze security events
  • Handle incidents according to procedures
  • Escalate to DFIR teams at the right time
  • Meet the defined SLAs

Global objective

  • Master alert triage and qualification
  • Conduct threat hunting activities
  • Apply the team's SOPs
  • Respect metrics and MCO

Partial objectives

  • SOC role and personal role
  • Incident Handling · UI onboarding
  • Notification setup · Log types
  • Threat Modeling (CKC / MITRE)
  • Mitigation actions · Security zones
  • Investigation · Inventory · Scripting
  • Reporting · Protocols · Team Play

Skills covered

The training covers all the skills an operational SOC analyst needs. Each skill is anchored in a hands-on workshop.

RoleSOC role & personal roleIHIncident HandlingUIInterface onboardingConfigNotification setupMCOOperational maintenance (MCO)LogsLog Types & TaxonomyCTIThreat Modeling: CKC / MITRE ATT&CKTriageUse Cases · Prioritization · FP/TPSOPOperating proceduresInvest.Investigation & ReportingZonesSecurity zones & Mitigation actionsInv.InventoryScriptScriptingAPIAutomation & SOARTeamTeam Play & Communication protocols

Detailed program: workshops & teaching methods

Each day alternates conceptual input and hands-on workshops. The teaching method is adapted to each theme to anchor learning in the operational reality of the SOC.

MondayIntroductionSOC

Framing & SOC culture

A first day of framing: understand the week's roadmap, take ownership of roles within the team, and anchor the fundamentals of Incident Handling in the SOC's operational culture. Analogy-based methods and true-or-false exercises test and correct initial assumptions.

Introduction: roadmap

Presentation of the path, objectives, expected deliverables and the week's assessment framework.

Weekly objectivesLearning contractDeliverable: personal roadmap
Briefing

SOC: roles & Incident Handling

Mapping of L1/L2/L3 roles, responsibilities and scopes. Incident lifecycle, escalation chain, SLAs and qualification criteria.

SOC roleIncident HandlingDFIR escalationSLADeliverable: team RACI
Analogy · True-or-false
TuesdayPreparationSources

Work environment & data sources

Full onboarding on the UI, alert and notification setup, and operational maintenance. In parallel, understanding log types and event taxonomy, with Chris Sanders' reference videos as self-paced learning material.

Preparation: UI, Config & MCO

Navigating the interface, configuring personal notifications, managing operational dashboards and checking MCO (source availability, endpoint coverage).

UINotificationsMCOCoverageInventoryDeliverable: validated personal config
Case study

Sources: Logs & Taxonomy

Identifying log types (network, endpoint, application, authentication), data models, normalization and taxonomy. Threat Modeling with the Cyber Kill Chain and MITRE ATT&CK.

Log TypesTaxonomyCKCMITRE ATT&CKThreat ModelingDeliverable: source matrix
Video (Chris Sanders)
WednesdayTriageInvestigation

From triage to investigation: the full cycle

The central day of the path. The morning is dedicated to triage through a firefighter role-play, simulating operational pressure and priority management under constraint. The afternoon moves to structured investigation, SOP writing and reporting through brainstorming and mind mapping.

Triage: Use Cases, Prioritization, FP/TP

Applying use cases, prioritization grid (criticality, context, frequency), identifying and handling false positives. Hands-on with a realistic alert flow.

Use CasesPrioritizationFalse PositivesTrue PositivesSecurity zonesDeliverable: triage grid
Firefighter role-play

Investigation: SOP & Reporting

Collaborative building of an investigation SOP, structuring incident reporting, mitigation actions and security zone definition. Basic automation scripting.

SOPReportingMitigationScriptingProtocolsDeliverable: SOP + report template
Brainstorm · Mind map
ThursdayAFESTReal conditions

On-the-job training action (AFEST)

A full AFEST day in two parts. In the morning, free-for-all autonomy: the learner handles real incidents without guidance, alone in front of the production environment. In the afternoon, guided and timed procedure: applying protocols under time pressure with an instructor observing.

AFEST: free autonomy (FFA)

Triage and investigation in real conditions, without assistance. Assessment of learning: autonomous application of use cases, triage, escalation and reporting on an unfiltered incident flow.

Autonomous triageInvestigationEscalationReportingAssessment: knowledge test
Knowledge test

AFEST: guided procedure

Applying SOPs and communication protocols on a simulated incident under time constraint. Assessment of procedural rigor, team communication and SLA compliance.

ProcessCommunicationTeam PlaySLAAssessment: timed score
Race against the clock
FridayAutomationWrap-up

Automation & week review

A final day focused on efficiency gains: API, SOAR, automated timelines and structured reporting. Problem solving as a teaching method anchors automation in real cases met during the week. The wrap-up session closes on individual and collective areas for progress.

Automation: API, SOAR, Timelines, Reports

Using APIs to automate recurring tasks, configuring SOAR playbooks, building incident timelines and generating automated reports. Advanced scripting applied to SOPs.

APISOARTimelinesReportsScriptingDeliverable: SOAR playbook
Problem solving

Wrap-up: review & individual roadmap

Week review, consolidation of learning, identification of priority areas for progress. Each participant leaves with a personal skills-development roadmap.

ReviewAreas for progressDeliverable: personal roadmap
Group debrief