NOA Labs
🚨 Security Operations · Corporate training

SOC & Incident Response

Run a modern security operations centre: SIEM detection engineering, alert triage, threat hunting, digital forensics and the full incident-response lifecycle.

Register your company → See the full outline ↓
$79 per employee · complete course
🗓️
3 weekends
Sat & Sun
⏱️
24 hours
6 live sessions
🎯
Advanced
Level
🧪
6 labs
Hands-on

Default hours 10:00 AM–2:00 PM (Asia/Karachi). Company pays — employees never pay individually.

About this training

Built for analysts and responders who defend live environments. Participants engineer detections mapped to MITRE ATT&CK, triage alerts efficiently, hunt for threats that bypass tools, collect forensic evidence and lead incidents from detection to lessons learned — including ransomware and business email compromise scenarios common in the financial sector.

Who it's for: SOC analysts (L1–L3), incident responders, threat hunters and security engineers.

What your team will be able to do

  • ✔Design SOC processes, tiers and metrics
  • ✔Engineer and tune SIEM detections mapped to ATT&CK
  • ✔Triage alerts and escalate correctly
  • ✔Hunt for threats proactively
  • ✔Lead an incident through the full response lifecycle

Advanced course outline

🔒 Session notes & lab guides unlock for enrolled employees
Weekend 1
Weekend 1 · Saturday

SOC foundations

People, process and technology of a SOC.

  • ▸SOC models: in-house, hybrid, managed
  • ▸Tiers, roles and escalation paths
  • ▸Log sources and visibility gaps
  • ▸SOC metrics: MTTD, MTTR, false-positive rate
  • ▸NIST CSF and incident-handling frameworks
🧪 Lab: Map log-source coverage 🔒 Session notes 🔒 Lab guide
Weekend 1 · Sunday

Detection engineering

Writing detections that catch real attacks.

  • ▸Detection-as-code with Sigma
  • ▸Mapping detections to ATT&CK
  • ▸Testing detections with attack simulations
  • ▸Tuning and suppressions
  • ▸Detection life cycle
🧪 Lab: Write and test Sigma rules 🔒 Session notes 🔒 Lab guide
Weekend 2
Weekend 2 · Saturday

Alert triage & investigation

Fast, consistent decisions on alerts.

  • ▸Triage methodology
  • ▸Enrichment with threat intelligence
  • ▸Phishing and BEC investigations
  • ▸Case management and documentation
  • ▸Escalation criteria
🧪 Lab: Triage an alert queue 🔒 Session notes 🔒 Lab guide
Weekend 2 · Sunday

Threat hunting

Finding attackers your tools missed.

  • ▸Hypothesis-driven hunting
  • ▸Hunting with endpoint telemetry
  • ▸Living-off-the-land techniques
  • ▸Baselining normal behaviour
  • ▸Turning hunts into detections
🧪 Lab: Hunt for living-off-the-land activity 🔒 Session notes 🔒 Lab guide
Weekend 3
Weekend 3 · Saturday

Digital forensics for responders

Collecting and analysing evidence correctly.

  • ▸Order of volatility and chain of custody
  • ▸Memory and disk acquisition
  • ▸Windows artefacts: event logs, prefetch, registry
  • ▸Remote collection with Velociraptor
  • ▸Building a timeline
🧪 Lab: Build an attack timeline 🔒 Session notes 🔒 Lab guide
Weekend 3 · Sunday

Incident response lifecycle & ransomware

Leading the response.

  • ▸Preparation, detection, containment, eradication, recovery
  • ▸Ransomware response decisions
  • ▸Communication with executives and regulators
  • ▸Post-incident review
  • ▸Capstone incident simulation
🧪 Lab: Capstone: lead a ransomware response 🔒 Session notes 🔒 Lab guide
📝
Final assessment & certificate
Multiple-choice assessment plus attendance requirement → verifiable QR certificate.

Enrol your team in SOC & Incident Response

One invoice for the whole team, volume discounts applied automatically.

Register your company → All corporate courses