C-02 — Program
SOC Internship
From beginner to corporate SOC skills. Learn to read alerts, investigate evidence and write clear incident tickets in a real Security Operations Centre workflow — taught by a working SOC analyst.
₹7,999₹35,0004 months — 3-month training + 1-month projectsLaunching 15 November 2026
Real-world SOC environmentLive threat analysisHands-on incident handlingCareer-ready skills
Register your seat
Takes a minute. We'll reach out about the batch, a free demo and fees.
3 months
SOC Training
- SOC fundamentals
- SIEM (Splunk / ELK)
- Threat detection & analysis
- Incident response & log analysis
- Real-world use cases
1 month
SOC Projects
- Hands-on SOC projects
- Real incident simulations
- Case studies & a capstone bank incident
- Build your portfolio + mentorship
What you'll earn
Your certificate of completion.
Finish the program and receive a verified Cybilution certificate in your name — unlocked on completion.
Locked
This certificate could carry your name.
Finish the SOC Internship to earn your own verified Certificate of Completion, issued in your name.
Start the internshipFull syllabus
Everything you'll learn.
Nine modules over four months — SOC and SIEM foundations, investigations and endpoint security, web & Active Directory, then 80+ tickets and a capstone bank incident. Tap any module to expand it.
- SOC roles and tiers, the CIA triad, MTTD / MTTR
- IPs, ports, TCP/UDP, DNS, HTTP/S, SMB, RDP and the OSI model
- Explain a Tier-1 shift and inspect network traffic in Wireshark
- Windows Event IDs 4624, 4625, 4688, 7045 and Linux auth logs
- SIEM concepts: inputs, streams, indices and search
- Read basic events and draw a log-source-to-alert workflow
- Agents/sidecars, collectors, API tokens, Winlogbeat & Filebeat
- Onboard Windows and Linux logs; verify incoming data
- Streams, stream rules, field parsing, extractors and firewall logs
- Detection patterns, time-range searches, pivots and investigation notes
- False positives, thresholds, known-good exclusions and Sigma concepts
- Investigate a simulated brute-force and an after-hours admin login
- XDR vs EDR vs antivirus, endpoint groups, policies and allowlisting
- Alert details, process trees, file hashes and threat details
- Produce an investigation summary from a safe test alert
- WAF rules, block/challenge actions, rate limiting and bot patterns
- Active Directory domains, users, groups and OUs
- Recognise the Windows event IDs that matter in an investigation
- Reputation checks with VirusTotal and AbuseIPDB; record evidence
- Map observed behaviour to MITRE ATT&CK concepts
- The IR workflow: prepare, detect, contain, eradicate, recover, learn
- 80+ module tickets: phishing & email, malware & endpoint, network & firewall, AD & login
- A repeatable method: read, validate, decide, write
- 100+ interview questions across four modules, plus mock-interview drills
- A full simulated bank incident report: timeline, affected assets, evidence and recommendations
- Hands-on SOC projects, real incident simulations and case studies for your portfolio
- Resume & LinkedIn optimisation, mock interviews and referral guidance