After this course you can take on the day-to-day work of a security operations centre: analyse logs, triage alerts, filter out false positives and pass genuine incidents on with the right information. You will also look actively for threats and know what is different about the cloud. The course suits you if you are starting out as a SOC analyst, already work in the first tiers or want to move from administration into security monitoring.
What you’ll take away.
- Understand the roles and workflows in a SOC
- Centralise logs and analyse them for indicators of compromise
- Assess alerts, prioritise them and pass them on correctly
- Hunt proactively for threats, including in cloud environments
Your training in detail
- Who is it for?
- Aspiring and current SOC analysts, and administrators who want to move into security monitoring.
- Prerequisites
- Basic cybersecurity and networking knowledge, including TCP/IP, firewalls and IDS/IPS. For the CSA certificate, EC-Council also requires enrolment in its official training programme.
- Format & planning
- Standard length: 3 training days. A different length can be arranged for companies.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
Security operations and SOC management
Cyber threats, indicators and attack methods
Log management
Incident detection and triage
Proactive threat detection
Response, forensics and malware analysis in overview
SOC for cloud environments
You work through a queue of simulated alerts, separate false positives from real incidents and write a handover to the next tier.
Exams, licences & credentials
This course follows the topics of the EC-Council 312-39 exam. The exam and its fees are included only if your offer confirms them. The certificate is issued by EC-Council, not NextNowa. EC-Council requires enrolment in the official CSA training and a passed exam. This course is not official EC-Council training and does not meet that condition. Check your route to the certificate with EC-Council before you book.
Vendor references & review date
Sources checked on 2026-11-04. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, dates and trainer are agreed before booking; the written offer is binding.
Frequently asked questions
What is the 312-39 exam like?
EC-Council lists 100 multiple-choice questions in three hours. You need at least 70 per cent to pass.
Which SOC tier is the course for?
EC-Council aims CSA mainly at aspiring and current Tier I and Tier II analysts.
Is this course enough for the CSA certificate?
No. EC-Council requires enrolment in the official CSA training, and this course is not official EC-Council training.
Does Certified SOC Analyst (CSA): working in a security operations centre include a certificate?
This course follows the topics of the EC-Council 312-39 exam. The exam and its fees are included only if your offer confirms them. The certificate is issued by EC-Council, not NextNowa. EC-Council requires enrolment in the official CSA training and a passed exam. This course is not official EC-Council training and does not meet that condition. Check your route to the certificate with EC-Council before you book.