Security Operations Center (SOC)

Security Operations Center (SOC)

This course is part of Cybersecurity Operations Fundamentals Specialization

Instructor: Cisco Learning & Certifications

39,641 already enrolled

Details to know

Shareable certificate

Add to your LinkedIn profile

Assessments

29 assignments

Taught in English

See how employees at top companies are mastering in-demand skills

Learn more about Coursera for Business

logos of Petrobras, TATA, Danone, Capgemini, P&G and L'Oreal

Build your subject-matter expertise

This course is part of the Cybersecurity Operations Fundamentals Specialization

When you enroll in this course, you'll also be enrolled in this Specialization.

Learn new concepts from industry experts
Gain a foundational understanding of a subject or tool
Develop job-relevant skills with hands-on projects
Earn a shareable career certificate

There are 8 modules in this course

If you are an associate-level cybersecurity analyst who is working in security operation centers, this course will help you acquire the fundamental skills required in a security operations center. You will learn the primary functions of a security operations center (SOC) and the critical role it plays in protecting organizational assets from cyber-attacks. By the end of the course, you will be able to:

• Gain an understanding of SOC team member’s daily activities and responsibilities. • Identify who these bad actors are, their motives, why they attack, and what they attack. • Review the goals of implementing a SOC and covers the business benefits that an organization achieves by employing a SOC. • Introduce technical and procedural challenges in a SOC. To be successful in this course, you should have the following background: 1. Skills and knowledge equivalent to those learned in Implementing and Administering Cisco Solutions (CCNA) v1.0 course 2. Familiarity with Ethernet and TCP/IP networking 3. Working knowledge of the Windows and Linux operating systems 4. Familiarity with basics of networking security concepts.

In this module, you will explore what a Security Operations Center, or SOC, does and how SOC team members support day-to-day security monitoring and response. You will identify common threat actors, their motivations, and the assets and systems they target. You will also examine why organizations implement SOCs, the business value they provide, and the technical and procedural challenges SOCs commonly face.

What's included

6 videos6 readings4 assignments

6 videosTotal 23 minutes

Introduction to Security Operations Center1 minute
SOC Defined4 minutes
SOC Environment Today7 minutes
Goal of a SOC4 minutes
Challenges of a SOC6 minutes
Wrap-Up1 minute

6 readingsTotal 18 minutes

Introduction to Security Operations Center2 minutes
SOC Defined2 minutes
SOC Environment Today5 minutes
Goal of a SOC4 minutes
Challenges of a SOC1 minute
Wrap-Up4 minutes

4 assignmentsTotal 60 minutes

SOC Environment Today10 minutes
Goal of a SOC Practice Quiz10 minutes
Challenges of a SOC Practice Quiz10 minutes
Introduction to Security Operations Center Course Exam30 minutes

In this module, you will examine the core responsibilities of a Security Operations Center (SOC) and how it works with other teams across the organization. You will place the SOC within the incident response lifecycle, from detection through recovery. You will also outline the key services a SOC provides across each incident response phase.

What's included

4 videos4 readings3 assignments

4 videosTotal 6 minutes

Introduction to Security Operations Center Processes and Services1 minute
SOC Interaction with Other Departments2 minutes
Common SOC Services2 minutes
Wrap-Up1 minute

4 readingsTotal 13 minutes

Introduction to Security Operations Center Processes and Services1 minute
SOC Interaction with Other Departments2 minutes
Common SOC Services7 minutes
Wrap-Up3 minutes

3 assignmentsTotal 40 minutes

SOC Interaction with Other Departments Practice Quiz10 minutes
Common SOC Services Practice Quiz10 minutes
Security Operations Center Processes and Services Course Exam20 minutes

In this module, you will distinguish common SOC types (for example, internal, outsourced, and hybrid) and the staffing considerations that shape each, such as roles, coverage models, and escalation paths. You will also compare SOC deployment models (on‑premises, cloud, and managed services) and connect each to typical consumer profiles based on needs like cost, control, scalability, and response expectations.

What's included

4 videos8 readings3 assignments

4 videosTotal 17 minutes

Introduction to SOC Deployment Models and Types1 minute
SOC Types and Staffing Considerations8 minutes
SOC Models and Their Consumers6 minutes
Wrap-Up1 minute

8 readingsTotal 25 minutes

Introduction to SOC Deployment Models and Types2 minutes
Introduction to SOC Types and Staffing Considerations1 minute
SOC Types and Staffing Considerations5 minutes
Compliance-Based SOC3 minutes
Operational-Based SOC5 minutes
Introduction to SOC Models and Their Consumers1 minute
SOC Models and Their Consumers5 minutes
Wrap-Up3 minutes

3 assignmentsTotal 40 minutes

SOC Types and Staffing Considerations Practice Quiz10 minutes
SOC Models and Their Consumers Practice Quiz10 minutes
SOC Deployment Models and Types Course Exam20 minutes

In this module, you will examine the core roles on an effective SOC team and how each role supports incident response. You will outline the key skills expected for common SOC positions and the primary tools each role relies on. You will also identify how SOC team members coordinate with one another and communicate with external groups during an incident.

What's included

4 videos7 readings3 assignments

4 videosTotal 9 minutes

Introduction to Staffing an Effective SOC Team1 minute
SOC Roles1 minute
Interaction of Various Roles Within the SOC6 minutes
Wrap-Up1 minute

7 readingsTotal 34 minutes

Introduction to Staffing an Effective SOC Team2 minutes
Introduction to SOC Roles3 minutes
SOC Roles5 minutes
SOC Tasks and Responsibilities Overview12 minutes
Introduction to Interaction of Different Roles Within the SOC1 minute
Interaction of Various Roles Within the SOC10 minutes
Wrap-Up1 minute

3 assignmentsTotal 40 minutes

SOC Roles Practice Quiz10 minutes
Interaction of Different Roles Within the SOC Practice Quiz10 minutes
Staffing an Effective SOC Team Course Exam20 minutes

In this module, you will identify the types of data a Security Operations Center (SOC) relies on and how security event data fits into SOC monitoring and analysis. You will distinguish SOC-relevant data sources and the kinds of events they produce. You will also review common SOC tools and the key features that support collecting, correlating, and analyzing security data.

What's included

5 videos14 readings3 assignments

5 videosTotal 15 minutes

Introduction to Security Events Data and SOC Analyst Tools1 minute
SOC Relevant Data and Security Event Data Introduction5 minutes
SOC Tools and Their Features5 minutes
SOC Tools and Their Features (Cont.)2 minutes
Wrap-Up1 minute

14 readingsTotal 66 minutes

Introduction to Security Events Data and SOC Analyst Tools2 minutes
SOC Relevant Data and Security Event Data Introduction3 minutes
Session Data3 minutes
Full Packet Capture4 minutes
Transaction Data3 minutes
Extracted Content4 minutes
Statistical Data4 minutes
Alert Data4 minutes
External Data3 minutes
Introduction to SOC Tools and Their Features2 minutes
SOC Tools and Their Features12 minutes
SOC Tools and Their Features (Cont.)13 minutes
Security Information and Event Management8 minutes
Wrap-Up1 minute

3 assignmentsTotal 40 minutes

SOC Relevant Data and Security Event Data Practice Quiz10 minutes
SOC Tools and Their Features Practice Quiz10 minutes
Security Events Data and SOC Analyst Tools Course Exam20 minutes

In this module, you will identify the external intelligence resources, regulatory bodies, and government and industry organizations a SOC communicates with. You will outline how these relationships support security operations and coordination across stakeholders. You will also describe the key policies, procedures, and governance rules that guide SOC engagement with users, HR, and legal when violations are detected.

What's included

4 videos6 readings3 assignments

4 videosTotal 14 minutes

Introduction to Developing Key Relationships with Internal and External Stakeholders2 minutes
Internal Stakeholders5 minutes
External Stakeholders6 minutes
Wrap-Up2 minutes

6 readingsTotal 37 minutes

Introduction to Developing Key Relationships with Internal and External Stakeholders5 minutes
Internal Stakeholders3 minutes
Internal Stakeholder Summary Table10 minutes
External Stakeholders4 minutes
External Stakeholder Summary Table5 minutes
Wrap-Up10 minutes

3 assignmentsTotal 40 minutes

Internal Stakeholders Practice Quiz10 minutes
External Stakeholders Practice Quiz10 minutes
Developing Key Relationships with Internal and External Stakeholders Course Exam20 minutes

In this module, you will focus on how SOC metrics are used to measure and communicate SOC effectiveness. You will examine core ideas behind security data aggregation and how it supports consistent reporting. You will explore Time to Detection (TTD) in a network security context and what it indicates about detection performance. You will consider how to describe the detection effectiveness of security controls using SOC-focused metrics.

What's included

6 videos6 readings5 assignments

6 videosTotal 12 minutes

Introduction to Understanding SOC Metrics1 minute
Security Data Aggregation3 minutes
Time to Detection2 minutes
Security Controls Detection Effectiveness2 minutes
SOC Metrics3 minutes
Wrap-Up1 minute

6 readingsTotal 40 minutes

Introduction to Understanding SOC Metrics3 minutes
Security Data Aggregation12 minutes
Time to Detection5 minutes
Security Controls Detection Effectiveness4 minutes
SOC Metrics15 minutes
Wrap-Up1 minute

5 assignmentsTotal 60 minutes

Security Data Aggregation Practice Quiz10 minutes
Time to Detection Practice Quiz10 minutes
Security Controls Detection Effectiveness Practice Quiz10 minutes
SOC Metrics Practice Quiz10 minutes
Understanding SOC Metrics Course Exam20 minutes

In this module, you will describe core SOC workflow management system (WMS) concepts and their role in security operations. You will outline how a typical workflow management system is integrated within a SOC. You will describe what SOC WMS integration involves across tools and processes. You will provide an example of how SOC workflow automation is applied in practice.