Payment by bank transfer · Moroccoتعلَّم · مارِس · أتقِن

Catalogue / Cybersecurity

SOC Analyst with Wazuh: Detecting and Responding to Attacks

The SOC analyst job from A to Z with Wazuh, the open-source SIEM and XDR platform. Install it, read logs, write rules, monitor file integrity, block an attacker, run the investigation and write the incident report.

  • Beginner to intermediate
  • 11 lessons
  • 9 h 35 min

A MasterLinux course · Original text

What you will learn

  • Understand the SOC analyst job, its tiers and the incident life cycle
  • Map an alert to MITRE ATT&CK tactics and techniques (T1110, T1136…)
  • Install an all-in-one Wazuh on your own virtual machine and enroll an agent
  • Read auth.log, secure and journald to spot a brute-force attack
  • Write custom Wazuh decoders and rules in XML
  • Monitor the integrity of sensitive files (FIM / syscheck)
  • Detect vulnerabilities and check configurations with SCA
  • Automatically block an IP address with active response
  • Go from a single alert to a complete attack timeline
  • Write a clear incident report, useful to management and to the national CERT

Course content

11 lessons · 9 h 35 min
Section 1 — The SOC and Wazuh3 lessons · 2 h 40 min
  1. The SOC analyst job: tiers, SIEM, incidents and MITRE ATT&CK Preview35 min
  2. Wazuh architecture: agent, manager, indexer and dashboard 35 min
  3. Install Wazuh all-in-one on your VM and enroll an agent 1 h 30 min
Section 2 — Detecting4 lessons · 2 h 50 min
  1. Read Linux logs and spot an SSH brute force 40 min
  2. Wazuh decoders and rules: write your own detections 45 min
  3. Monitor file integrity (FIM) with syscheck 40 min
  4. Vulnerabilities and configuration assessment (SCA) 45 min
Section 3 — Responding and investigating3 lessons · 2 h 5 min
  1. Active response: automatically block an attacker 40 min
  2. Investigation: from the alert to the attack timeline 45 min
  3. Write an incident report 40 min
Section 4 — Final project1 lesson · 2 h
  1. Final project: simulate, detect, investigate, report 2 h

Requirements

  • The “Fundamentals” course (included) or solid hands-on experience with the Linux command line
  • Basic networking concepts (IP addresses, ports, SSH)
  • A Debian or Ubuntu virtual machine with 4 GB of RAM to install Wazuh

Who is this course for?

  • Graduates and technicians aiming for a tier 1 or tier 2 SOC analyst position
  • System administrators who want to monitor and protect their servers
  • Students preparing a career in cybersecurity in Morocco or abroad