| Select Package | Comprehensive Assured Pacakge, Training with Examination, Training with LMS |
|---|
Please share your query, and our team will respond shortly
EC-Council Certified SOC Analyst (CSA)
The Certified SOC Analyst V2 (CSA V2) Training establishes a comprehensive foundation for contemporary Security Operations Centers (SOC). The program, revised for 2026, conforms to the latest CSA V2 syllabus from EC-Council and provides learners with practical skills in SOC monitoring, SIEM operations, log analysis, threat intelligence, alert triage, and incident response workflows.
Overview
Designed to equip newcomers and early-career security professionals with the precise skills required by contemporary SOC teams, the Certified SOC Analyst (CSA V2) Training is offered by The course, grounded in the revised EC-Council CSA V2 syllabus, starts with basic concepts like SOC architecture, roles, processes, attacker behaviors, and threat landscapes. It then advances to a deeper exploration of attacker TTP analysis using MITRE ATT&CK, IoC identification, integration of threat intelligence, and practical simulations of alert triage. It ends with comprehensive incident response workflows, documentation mandates, escalation protocols, and AI-aided detection models utilized in 2026 SOC environments.
What you will Learn in this EC-Council Certified SOC Analyst (CSA) course?
- Build a strong foundation in SOC operations, security monitoring, log management, SIEM workflows, and threat detection concepts.
- Develop hands-on SOC skills including log correlation, alert triage, IoC analysis, threat intelligence integration, and MITRE ATT&CK mapping.
- Train participants to detect, investigate, escalate, and document security incidents in alignment with modern SOC L1-L2 practices.
- Prepare learners to confidently clear the EC-Council Certified SOC Analyst (CSA V2) certification exam and step into SOC Analyst roles.
Who should go for EC-Council Certified SOC Analyst (CSA) course?
- Tier I and Tier II SOC Analysts (entry- to intermediate-level)
- Cybersecurity Analysts, Network Security Engineers/Administrators, Network Defense Analysts, Network & Security Technicians/Operators/Specialists
- Entry-level cybersecurity professionals seeking to build core SOC skills
- IT/Network/System Administrators or Engineers wanting to transition into SOC/security monitoring roles
- Anyone aiming to become a SOC Analyst, aspiring professionals, career switchers, or freshers with interest in SOC operations
Our Package
Module 1: Security Operations and Management
- Key topics covered:
- SOC, SOC Capabilities, SOC Operations, SOC Workflow, Components of SOC, SOC Models, SOC Maturity Models, SOC Generations, SOC KPIs and Metrics, SOC Challenges
Module 02: Understanding Cyber Threats, IoCs, and Attack Methodology
Key topics covered:
-
-
- Cyber Threats, TTPs, Reconnaissance Attacks, Man-in-the-Middle Attacks, Password Attack
Techniques, Malware Attacks, Advanced Persistent Threat Lifecycle, Host-Based DoS Attacks,
Ransomware Attacks, SQL Injection Attacks, XSS Attacks, Cross-Site Request Forgery (CSRF)
Attack, Session Attacks, Social Engineering Attacks, Email Attacks, Insider Attacks, IoCs,
Attacker’s Hacking Methodology, MITRE D3FEND Framework, Diamond Model of Intrusion Analysis
- Cyber Threats, TTPs, Reconnaissance Attacks, Man-in-the-Middle Attacks, Password Attack
-
Hands-on labs:
-
-
-
- Perform SQL Injection Attack, Cross-Site Scripting (XSS) Attack, Network Scanning Attack, DoS Attack,
and Brute Force Attack to understand their TTPs and IoCs. - Detect and analyze IoCs using Wireshark.
- Perform SQL Injection Attack, Cross-Site Scripting (XSS) Attack, Network Scanning Attack, DoS Attack,
-
-
Module 03: Log Management
Key topics covered:
-
-
- Incident, Event, Log, Log Sources, Log Format, Local Logging, Windows Event Log, Linux Logs, Mac
Logs, Firewall Logs, IP tables, Router Logs, IIS Logs, Apache Logs, Database Logs, Centralized
Logging, Log Collection, Log Transmission, Log Storage, AI-Powered Script for Log Storage, Log
Normalization, Log Parsing, Log Correlation, Log Analysis, Alerting and Reporting
- Incident, Event, Log, Log Sources, Log Format, Local Logging, Windows Event Log, Linux Logs, Mac
-
Hands-on labs:
-
- Configure, monitor, and analyze various logs.
- Collect logs from different devices into a centralized location using Splunk.
Module 04: Incident Detection and Triage
Key topics covered:
-
-
- SIEM, SIEM Architecture and its Components, AI-Enabled SIEM, Types of SIEM Solutions, SIEM Deployment, SIEM Use Cases, SIEM Deployment Architecture, SIEM Use Case Lifecycle,Application-Level Incident Detection SIEM Use Cases, Insider Incident Detection SIEM Use Cases,Examples of Network Level Incident Detection SIEM Use Cases, Examples of Compliance Use Cases,SIEM Rules Generation with AI, Alert Triage, Splunk AI, Elasticsearch AI, Alert Triage with AI,Dashboards in SOC, SOC Reports
-
- Hands-on labs:
- Develop Splunk use cases to detect and generate alerts for brute-force attempts, ransomware attacks, SQL injection attempts, XSS attempts, Broken Access Control attempts, application crashes using Remote Code Execution, scanning attempts, monitoring insecure ports and services, HTTP flood/denial of service (DoS) attacks, monitoring Windows audit log tampering, and malicious PowerShell script execution.
- Enhance alert triage using the SIGMA rules for Splunk queries.
- Create dashboards in Splunk.
- Create ELK use cases for monitoring trusted binaries connecting to the internet, credential dumping using Mimikatz, and monitoring malware activity in the system.
- Create dashboards in ELK.
- Detect brute-force attack patterns using correlation rules in ManageEngine Log 360.
Module 05: Proactive Threat Detection
Key topics covered:
-
-
- Cyber Threat Intelligence (CTI), Threat Intelligence Lifecycle, Types of Threat Intelligence,Threat Intelligence Strategy, Threat Intelligence Sources, Threat Intelligence Platform (TIP),Threat Intelligence-Driven SOC, Threat Intelligence Use Cases for Enhanced Incident Response,Enhanced Threat Detection with AI, Threat Hunting, Threat Hunting Process, Threat Hunting Frameworks, Threat Hunting with PowerShell Script, PowerShell AI Module, Threat Hunting with AI,Threat Hunting with YARA, Threat Hunting Tools
-
- Hands-on labs:
- Integrate IoCs into the ELK Stack.
- Integrate OTX threat data into OSSIM.
- Detects incidents in Windows Server using YARA.
- Conduct threat hunting using Windows PowerShell scripts, Hunt Manager in Velociraptor, Log360 UEBA, and Sophos Central.
Module 06: Incident Response
Key topics covered:
-
-
- Incident Response (IR), IRT, SOC and IRT Collaboration, IR Process, Ticketing System, Incident Triage, Notification, Containment, Eradication, Recovery, Network Security Incident Response,Application Security Incident Response, Email Security Incident Response, Insider Threats and Incident Response, Malware Threats and Incident Response, SOC Playbook, Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), SOAR, SOAR Playbook
-
- Hands-on labs:
- Generate tickets for incidents.
- Contain data loss incidents.
- Eradicate SQL injection and XSS incidents.
- Perform recovery from data loss incidents.
- Create incident reports using OSSIM.
- Perform automated threat detection and response using Wazuh.
- Detects threats using Sophos Central XDR.
- Integrate Sophos Central XDR with Splunk.
Module 07: Forensic Investigation and Malware Analysis
Key topics covered:
-
-
- Forensics Investigation, Forensics Investigation Methodology, Forensics Investigation Process,Forensics Investigation of Network Security Incidents, Forensics Investigation of Application Security Incidents, Forensics Investigation of Email Security Incidents, Forensics Investigation of Insider Incidents, Malware Analysis, Types of Malware Analysis, Malware Analysis Tools,Static Malware Analysis, Dynamic Malware Analysis
-
- Hands-on labs:
- Perform forensic investigation of application security incidents: SQL Injection Attacks.
- Perform forensic investigation of a compromised system incident using Velociraptor.
- Analyze RAM for suspicious activities using Redline.
- Perform static analysis on a suspicious file using PeStudio.
- Examine a suspicious file using VirusTotal.
- Perform dynamic malware analysis in Windows using Process Hacker.
Module 08: SOC for Cloud Environments
Key topics covered:
-
-
- Cloud SOC, Azure SOC Architecture, Microsoft Sentinel, AWS SOC Architecture, AWS Security Hub,Centralized Logging with OpenSearch, Google Cloud Platform (GCP) Security Operation Center,Security Command Center, Chronicle
-
- Hands-on labs:
- Implement Microsoft Sentinel in Azure.
Upcoming Batch
April 20th (Weekends)
FRI & SAT (4 Weeks)
08:30 PM to 01:00 AM (CDT)
April 18th (Weekdays)
MON – FRI (18 Days)
10:00 AM to 12:00 PM (CDT)
EC-Council Certified SOC Analyst (CSA) FAQs
Q. What is the Certified SOC Analyst (CSA) V2 certification?
Ans.
The Certified SOC Analyst (CSA) V2 is EC-Council’s updated, globally recognized certification designed to validate foundational skills in Security Operations Center (SOC) monitoring, log analysis, threat detection, and incident response. It prepares candidates for real-world SOC Analyst (L1–L2) roles using modern tools, frameworks, and attack scenarios.
Q. Who can join the SOC Analyst V2 training?
Ans.
The training is ideal for: Tier I and Tier II SOC Analysts (entry- to intermediate-level) Cybersecurity Analysts, Network Security Engineers/Administrators, Network Defense Analysts, Network & Security Technicians/Operators/Specialists Entry-level cybersecurity professionals seeking to build core SOC skills IT/Network/System Administrators or Engineers wanting to transition into SOC/security monitoring roles Anyone aiming to become a SOC Analyst, aspiring professionals, career switchers, or freshers with interest in SOC operations
Q. What skills are covered in the SOC Analyst V2 course?
Ans.
Learners gain skills in: SOC monitoring & security operations Log management & event correlation SIEM operations (rule creation, dashboards, alert triage) Threat intelligence & IoC analysis Incident response workflows Threat hunting methodologies MITRE ATT&CK mapping AI-driven detection and automated playbooks Cloud SOC environments (Azure, AWS, GCP)
Q. Is the CSA V2 certification globally recognized?
Ans.
Yes. CSA V2 is a globally recognized certification.
Q. Will I receive a certificate after completing the CSA V2 training?
Ans.
Yes, you will get a completion certificate.
Reviews
There are no reviews yet.