Udemy – SOC Alert Investigation Lab: Real-World Workflow

This hands-on SOC Alert Investigation Lab takes you through a realistic end-to-end investigation using Microsoft Defender XDR and AWS security telemetry. You will follow the same investigation progression used in a SOC environment, starting with Tier 1 alert triage and moving into deeper Tier 2 investigation.

Throughout the lab, you will learn how to:

• Triage a high-severity security alert
• Identify affected users, hosts, and cloud resources
• Collect and document investigation evidence
• Decide when an alert should be escalated from Tier 1 to Tier 2
• Correlate multiple alerts and related security activity
• Reconstruct an investigation timeline
• Assess incident scope and potentially affected resources
• Investigate AWS root-account credential activity
• Analyze access-key and MFA-related security events
• Identify investigation gaps and telemetry limitations
• Analyze automated remediation results