Free courseTechnology & IT
Inside a Security Operations Centre: Logs and Alerts
Find out how a Security Operations Centre works: read sign-in logs, triage alerts, separate false positives from real problems and escalate clearly. Five short lessons and a quiz, with a certificate of completion.
60minutes
5lessons
1final quiz
Freecertificate of completion
What you’ll be able to do
- Explain what a SOC does, the tools it uses and how Tier 1, Tier 2 and Tier 3 work fits together
- Read a Linux SSH log line and a Windows sign-in event and say who, what, where and with what result
- Recognize brute force, password spraying and credential stuffing by counting accounts, addresses and attempts
- Triage an alert with a five-step routine and classify it as a true or false positive
- Write a clear escalation message and a shift handoff note
- Describe when a breach involving personal information may need to be reported in Alberta and Canada
Curriculum
01
Course lessons
5 lessons · module quiz- 01
What a Security Operations Centre doesLesson - 02
Reading logs: Linux and Windows sign-in recordsLesson - 03
Spotting suspicious sign-insLesson - 04
Alert triage and false positivesLesson - 05
Escalation, handoffs and reportingLesson - 06
QUIZInside a Security Operations Centre: final quizQuiz