The EC-Council C|SA program provides training and certification in the fundamental principles and practices of security operations, threat intelligence, and incident response. It delivers a comprehensive understanding of the processes, technologies, and techniques used to detect, investigate, and respond to cybersecurity threats.
The Certified SOC Analyst (C|SA) training program covers a broad range of topics, including common attack vectors, security tools and technologies, Security Information and Event Management (SIEM), incident response procedures, SOC coordination, and SOC development. Participants gain hands-on proficiency in centralized log management (CLM), incident triaging, and the identification and investigation of indicators of compromise (IoCs) and the cyber kill chain, enabling proactive threat detection and response.
The program also equips learners with the skills to identify emerging threat patterns, develop correlation rules, and create effective reporting mechanisms that support a strong organizational security posture. In addition, students learn how to leverage AI-enabled tools and platforms to enhance SIEM capabilities, behavior analytics, alert prioritization, and automated threat detection and threat hunting using solutions such as Splunk AI, Elastic AI, Copilot, ChatGPT, and PowerShell AI.
Upon completing the EC-Council C|SA course, participants will be equipped with the practical knowledge and technical capabilities required to operate and support a robust Security Operations Center (SOC) with enhanced incident detection and response capabilities.
Updated 19/05/2026
Learn how a Security Operations Center (SOC) enhances an organization’s overall security management and helps maintain a strong security posture. This module focuses on the critical roles of people, technology, and processes in effective SOC operations.
Module 02 – Understanding Cyber Threats, IoCs, and Attack MethodologyExplore various cyberattacks, their Indicators of Compromise (IoCs), and the tactics, techniques, and procedures (TTPs) commonly used by cybercriminals.
Module 03 – Log ManagementUnderstand log management within SIEM environments, including how logs are generated, stored, centrally collected, normalized, and correlated across multiple systems.
Module 04 – Incident Detection and TriageLearn SIEM fundamentals, including deployment strategies, use case development, and how SOC analysts use SIEM platforms to detect anomalies, triage alerts, and report security incidents.
Module 05 – Proactive Threat DetectionLearn the importance of threat intelligence and threat hunting for SOC analysts, and how integrating these capabilities with SIEM reduces false positives and enables faster, more accurate alert triage.
Module 06 – Incident ResponseUnderstand the stages of incident response and how Incident Response Teams (IRT) collaborate with SOC teams to investigate, manage, and respond to escalated security incidents.
Module 07 – Forensic Investigation and Malware AnalysisLearn the role of forensic investigation and malware analysis in SOC operations to better understand attack methodologies, identify IoCs, and strengthen future security defenses.
Module 08 – SOC for Cloud EnvironmentsExplore SOC operations in cloud environments, including monitoring, incident detection, automated response, and cloud security practices across AWS, Azure, and GCP using cloud-native security tools.
NOK 24.000
