Security Operations: Monitoring, Detection and Alert Triage

Work like a security operations centre analyst: read the logs that matter, write and test detection rules in Python, look at traffic in Wireshark, and triage alerts into clear findings.

Intermediate · Cybersecurity · about 10 hours · 4 modules · certificate on completion

Taught by Rodrigoò Silvà, Chukwuemekà Obiechè, AI Learning Companions.

About this course

A security operations centre (SOC) is where an organisation watches for trouble and decides, many times a day, what deserves a response. This course teaches that work from the analyst's chair. You'll learn which logs matter and how to read them: authentication logs, web server access logs, firewall logs and operating system event logs, and how a SIEM collects and normalises them so one search covers everything.

The labs follow one day on a payments server through a SOC's workflow. You'll find repeated failed logins with grep and Python, connect web and firewall logs to the same addresses, look at your own traffic in Wireshark, write threshold and sequence detections in Python and prove them with tests, then triage a queue of alerts using asset, scanner, staff and change records, separating real incidents from false positives and writing them up as a clear ticket. The capstone is a fresh day of logs to monitor end to end. All of it is defensive practice on sample data and your own machine.

What you'll learn

  • Explain what a security operations centre does and how events become alerts and incidents
  • Read operating system, authentication, web server and firewall logs and find what matters in them
  • Analyse logs with grep and Python, and look at your own network traffic in Wireshark
  • Write detection rules with thresholds and time windows, and test them before they go live
  • Triage alerts with context, separate false positives from real incidents, and document findings

Skills you'll gain

Security monitoring, Log analysis, Detection engineering, SIEM concepts, Alert triage, False positive tuning, Network traffic analysis, Python for security, Incident documentation

Tools

Python, Wireshark, grep

Before you start

Basic Python (reading files, loops, dictionaries and functions) and comfort in a terminal. Python 3.10 or later and Wireshark installed; on Windows, grep is available in Git Bash or WSL, and every grep step has a Python alternative. An introductory security course, or equivalent knowledge of accounts, logs and networks, helps.

Modules

  1. Security operations and the logs that matter

    What a SOC does, how raw events become alerts and incidents, and the operating system and authentication logs that analysts read every day.

    • What a security operations centre does (10 min)
    • Events, alerts and incidents (10 min)
    • Operating system and authentication logs (12 min)
    • Hands-on lab: Find repeated failed logins in an auth log

  2. Web, firewall and network evidence

    Read web server access logs and firewall logs, connect them by address and time, and look at network traffic itself with Wireshark.

    • Web server access logs (10 min)
    • Firewall logs and network flows (10 min)
    • Looking at traffic with Wireshark (12 min)
    • Hands-on lab: Investigate web, firewall and network evidence

  3. Centralising logs and writing detections

    How SIEMs collect and normalise logs so one search covers every system, how detection rules are designed, and how to test and tune them like code.

    • Centralising logs and SIEM concepts (12 min)
    • Writing detection rules (12 min)
    • Testing and tuning detections (10 min)
    • Hands-on lab: Write and test login detections in Python

  4. Alert triage and documenting findings

    Decide quickly and consistently what each alert means, deal with false positives without blinding the SOC, and write findings that others can act on.

    • Triage: from alert to decision (10 min)
    • False positives and tuning (10 min)
    • Documenting findings and handing over (10 min)
    • Hands-on lab: Triage an alert queue

Project: Monitor a day on the shop server

You're the analyst on duty for shop01, an online shop's internet-facing web and SSH server, for Monday 12 October 2026. You have its authentication log, web access log and firewall log, plus context: the asset list, staff and service accounts, and the scanner allowlist. Build a small monitoring pipeline in Python: parse all three logs into one normalised event format, write at least three detection rules with tests, run them over the day, and triage every alert they raise using the context files. Somewhere in the noise is one real incident. Find it, write it up as an incident ticket, and recommend how to tune any rule that was noisy.

Part of

The products this course names are trademarks of their owners, who haven't made or endorsed it.

Start the course free