Greater Baltimore Cares (501C3)

THE Security operations center ANALYST TRACK

Preparation Materials

WATCH : What is a Security operations center (SOC)

This is a very simple portrayal on the complex workings of a Security Operations Center (SOC).

Elastic Quick Starts.

Your CyberShip internship will focus on the use of the Elastic SIEM as part of your daily job duties.
Each of these courses are no longer than 15 minutes and will provide you with an overview of the tools from Elastic you will use as part of your security operations center internship.

Course 1

Logging Quick Start

In this Quick Start guide, you’ll learn how to ingest, view, and analyze custom logs from your applications using Elastic Cloud. Paired with metrics and APM traces, logs are a critical piece in creating unified observability of your ecosystem.

Course 2

Metrics Quick Start

This Quick Start guide will help you get started with metrics using Elastic Cloud Service. You will learn how to stream, visualize, and analyze metrics. Paired with logs and APM traces, infrastructure metrics are a critical piece in creating unified observability of your ecosystem.

Course 3

APM Quick Start

In this Quick Start guide, you'll learn how to stream, view, and analyze APM traces from your applications using Elastic Cloud. Paired with logs and metrics, APM traces are a critical piece in creating unified observability of your ecosystem.

COURSE 4

Workplace Search Quick Start

In this Quick Start guide, you’ll learn about Elastic Workplace Search: a single search experience for your teams to search across all your content platforms, like Google Drive, Salesforce, and Confluence, to name just a few. See how to quickly get set up, synchronize data to Workplace Search, and optimize the search experience for different members of your organization.

Course 5

App Search Quick Start

In this Quick Start guide, you'll learn how to stream, view, and analyze APM traces from your applications using Elastic Cloud. Paired with logs and metrics, APM traces are a critical piece in creating unified observability of your ecosystem.

COURSE 6

Elastic Security Quick Start

In this Quick Start guide, you'll learn how to configure your endpoints with Elastic Security so you can stream, detect, and visualize threats in real time on Elastic Cloud.

Splunk is another popular SOC tool used by many companies and the link below is to a free introductory short course from Splunk. The goal would be that after taking the Elastic introductory modules and taking a quick look at what Splunk is, you will complete your internship with some familiarity of two of the top SIEM tools used in SOCs all over the world. There are many others, but the fundamentals are the same.

Go to Splunk Training

If you have any questions, please feel free to reach out to us!