Rod Soto - SOC 101 - SOC 1 Analyst Bootcamp DCTLV2025

Name of Training: SOC 101 - SOC 1 Analyst Bootcamp
Trainer(s): Rod Soto
Dates: August 11-12, 2025
Time: 8:00 am to 5:00 pm PT
Venue: Las Vegas Convention Center
Cost: $1,700

Course Description: 

This course introduces students to Security Operations Center (SOC) skills and tools, providing a comprehensive foundation in the essential skills required for SOC analysts. Through extensive hands-on exercises and labs that mirror real-life SOC tasks and technologies, students will gain a practical, skill-based understanding of modern security operations.

Key areas of focus will include text handling, packet dissection, and analysis, adversarial simulation, and detection engineering, equipping students with the expertise needed for various SOC tasks. The course emphasizes practical, foundational skills to ensure students are prepared to excel at core SOC tasks, this course will also introduce students to AI tools that improve SOC efficiency, accuracy, and response time in a rapidly evolving security landscape.

Course Outline: 

Day 1

1. Introduction to SOC
   1. A brief overview of the importance of SOC in cybersecurity
2. Understanding Risk and Threats
   1. Defining risk, threats, and vulnerabilities in a SOC context
3. SOC Frameworks and Models
   1. Overview of common SOC frameworks and models (e.g., NIST Cybersecurity Framework)
4. Security Controls and Countermeasures
   1. Types of security controls and countermeasures used in a SOC environment
5. Implementing and Auditing Access Controls
   1. File & Folder, User & Processes permissions
6. Triaging events and escalating incidents (Events vs Incidents)
   1. Steps in triaging Incidents, Classification and Escalation
7. Logs and logging basics
   1. Types of logs, text manipulation, log storage and locations for Linux/Windows. 
8. Log auditing and management
   1. Logging collection frameworks and configuration 
9. Network Security Basics
   1. TCP IP OSI Model and relevant attacks
   2. Packet Capture fundamentals
   3. Packet Capture Tools
   4. Intrusion detection 
   5. DNS basics and related attacks
10. Network Analysis and threat detection 
    1. Zeek, Arkime, Suricata
11. Industry Nomenclature
    1. Mitre CVE, ATT&CK, CWE 
    2. OWASP Top 10
    3. LM Killchain
    4. Industry Compliance Framework
12. Vulnerabilities, Risks & Threats
13. CVSS, TLP
14. Web Attacks and WAF Logs

Day 2

1. Log centralization and normalization (Sysmon, Syslog, WEC)
2. Security Centric Logs (Sysmon, AD Audit Policies)
3. Linux Logs (syslog, rsyslog)
4. CIS Benchmarks. Log Management 
   1. CIS Log benchmarks in Linux Systems
   2. CIS Log benchmarks in Windows Systems
5. SIEM and SOC Operation (Threat Detection, Threat Hunting)
6. Introduction to Elastic stack (install, operation and threat detection hands on)
7. Introduction to Splunk (Install, operation and threat detection hands on) 
8. Introduction to EDR 
9. Wazuh install, operation and threat detection
10. Introduction to OS query
11. Adversarial Simulation (AS Frameworks & Purple Teaming)
12. Detection Engineering
13. Cryptography & the SOC
14. SOC Periphery Teams
15. SOC & AI (Models, Agents, LLMs hands on)
16. CTF

Difficulty Level:

Beginner

Suggested Prerequisites:

Understanding of basic networking concepts and basic Linux comprehension.

This training is geared towards Information Technology, Computer System, or Computer Network Professionals seeking to enter the Information Security Industry while enriching those who seek to develop the skills and knowledge necessary to work at a Security Operations Center.

What Students Should Bring: 

A laptop with at least 16GB of RAM and the ability to run Virtual Machines (GPUs recommended). 

Please do not bring Apple M chip based laptops as they cannot virtualize x86, x64 instances.

Trainer(s) Bio:

Rod Soto has over 15 years of experience in information technology and security. He has worked in Security Operations Centers as a support engineer, soc engineer, security emergency response, and incident response. He is currently working as a detection engineer and researcher at Splunk Threat Research Team and has previously worked at Prolexic/AKAMAI, Splunk UBA, JASK (SOC Automation). 

Rod Soto was the winner of the 2012 BlackHat Las Vegas CTF competition and Red Alert ICS CTF at DEFCON 2022 contest. He has spoken at ISSA, ISC2, OWASP, DEFCON,  RSA Conference,Hackmiami, DerbyCon, Splunk .CONF, Black Hat,BSides, Underground Economy and also been featured in Rolling Stone Magazine, Pentest Magazine, Univision, BBC, Forbes, VICE, Fox News and CNN.

Registration Terms and Conditions: 

Trainings are refundable before July 8, 2025, minus a non-refundable processing fee of $250.

Trainings are non-refundable after July 8, 2025.

Training tickets may be transferred. Please email us at training@defcon.org for specifics.

If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).

Failure to attend the training without prior written notification, will be considered a no-show. No refund will be given.

By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.

Several breaks will be included throughout the day. Please note that food is not included.

All courses come with a certificate of completion, contingent upon attendance at all course sessions.