This security operations training teaches you to analyse logs and alerts, prioritise incidents and document them cleanly. It is aimed at aspiring and active SOC analysts, administrators with security duties and IT teams building up their capability. You work with a SIEM, write queries, map findings to MITRE ATT&CK and follow a NIST-based incident handling flow, so decisions stay traceable.
What you’ll take away.
- Read and correlate log sources such as Windows events, firewall and proxy
- Write queries in a SIEM such as Microsoft Sentinel using KQL
- Triage alerts by risk and close false positives with justification
- Map suspicious behaviour to tactics and techniques in MITRE ATT&CK
- Document incidents to a fixed structure and hand over actions
Your training in detail
- Who is it for?
- Aspiring SOC analysts, administrators with security duties and IT teams building detection and response.
- Prerequisites
- Basics in networking, operating systems and IT security. Experience with Windows and Linux logs helps.
- Format & planning
- Suggested format: 3 to 4 days live online or on site. Scope depends on prior knowledge.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
SOC structure: roles, tiers of analysis, event versus incident and measures such as detection and response time.
Log sources: Windows security events, Sysmon, Linux auth.log, DNS, proxy and firewall logs.
SIEM practice: data connectors, queries in KQL, analytics rules, dashboards and correlation across sources.
Triage: scoring alerts by criticality, enrichment with threat intelligence, IOC checks and escalation paths.
Attack patterns: the MITRE ATT&CK Enterprise Matrix, typical sequences such as phishing, credential access and lateral movement.
Incident handling: flow according to NIST SP 800-61 Rev. 3, containment, evidence preservation, documentation and review.
Suggested exercise: find a chain of failed logons followed by a success in a prepared log dataset, map it to ATT&CK and write an incident report.
Exams, licences & credentials
A related qualification is the Microsoft Security Operations Analyst Associate (exam SC-200). The training is vendor-neutral and only prepares for it if agreed in the offer. Exam fees and licences are only included if confirmed. Attending alone awards no vendor certification.
Vendor references & review date
Sources checked on 2026-11-03. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, duration, dates, trainer and price are agreed before booking.
Frequently asked questions
What does a SOC analyst do day to day?
They review alerts from monitoring systems, decide whether a real incident exists, collect evidence in logs and escalate or close the case with a reason. Reporting and tuning rules come on top. The training practises exactly this flow on sample data.
Do I need a SIEM to learn security operations?
Not strictly to begin with, as the method of triage, correlation and documentation applies everywhere. A SIEM does make working with large data volumes tangible. We use an example such as Microsoft Sentinel and transfer the concepts to your own tool if it differs.
What is MITRE ATT&CK useful for?
It is a public knowledge base of adversary tactics and techniques. You classify observations, speak the same language across the team and spot gaps in your detection. It is an aid for classification, not a replacement for your own analysis. We use it in exercises and reports.
Does Security operations include a certificate?
A related qualification is the Microsoft Security Operations Analyst Associate (exam SC-200). The training is vendor-neutral and only prepares for it if agreed in the offer. Exam fees and licences are only included if confirmed. Attending alone awards no vendor certification.