Evergreen Alliance Training Program for GIAC Security Operations Certified (GSOC)

Analytic Design and Tuning
The candidate will understand how to design, enhance, test, share, and continuously improve analytics.

Blue Team Defense Concepts
The candidate will be able to explain the purpose of a SOC/Blue Team, its role in managing organizational risk, and common methods for SOC monitoring and incident response.

Endpoint Defense
The candidate will be familiar with common endpoint attacks, how to defend against them, and how endpoint devices log events.

HTTP(S) Analysis and Attacks
The candidate will understand how to identify and defend against common attacks targeting HTTP(S) traffic.

Interpreting Events
The candidate will be able to identify common events in Windows and Linux systems, locate and interpret them in logs, and extract information from potentially malicious files.

Intrusion Triage and Analysis
The candidate will understand how to prioritize security incidents, incorporating organizational factors into analysis and response.

Network Traffic Analysis
The candidate will have a high-level understanding of enterprise network architecture and monitoring, be able to review network traffic, and identify and defend against DNS attacks.

Operational Improvement
The candidate will understand how to enhance Blue Team operational efficiency through task automation, response orchestration, and staff training.

Protocol Attacks and Analysis
The candidate will understand the purpose of common network protocols (such as SMTP, SMB, DHCP, ICMP, FTP, and SSH), typical attack tactics, and how to defend against them.

SOC Management Systems
The candidate will be familiar with the role and function of common Incident Management Systems, Threat Intelligence Platforms, and SIEMs.