Work through a lab
Free, public, no sign-up. The same labs used inside the programme. If the teaching does not suit you, you will know in an evening.
Open the free labsSOC Analyst (Splunk & Sentinel)
Work an alert queue without guessing, build detections that survive a false-positive pass, and write the incident record someone can act on cold.
Detection, triage and investigation hands-on in Splunk and Microsoft Sentinel, from log sources to written incident reports. Weekly 1:1, labs reviewed every week.
What you will be able to do
- Work an alert queue to an SLA without guessing
- Investigate in both Microsoft Sentinel and Splunk, and write the query yourself
- Build and tune detections that survive a false-positive pass
- Triage a phishing report end to end — the most common ticket you will see
- Reconstruct an attack as a defensible timeline
- Write an incident record and a handover someone can act on cold
- Map activity to MITRE ATT&CK and find the coverage gaps
Who it is for
- Students and graduates targeting a SOC or detection role
- Helpdesk, NOC and sysadmin professionals moving into blue team
- Red-leaning learners who want the defender’s side of the same techniques
- Anyone who has a SIEM certificate but has never worked a real alert queue
Two sessions a week, five days of doing
Two live 1:1 sessions every week, on days fixed with you once we start. The other five days are yours to work — research, assignments, labs, writeups. Session length is agreed per student and can change as you go.
- Two live 1:1 sessions a week, on days agreed with you
- The remaining five days are for the work — research, assignments, labs, reports
- Session hours are set per student, and can be adjusted mid-programme
- Everything you hand in is reviewed before the next session
My job
- Guide you — tell you how to do things, and why it is done that way
- Tell you what you need to do, and when to do it
- Review everything you produce and tell you plainly where it falls short
- Keep the plan honest as you change and as the field changes
Your job
- Do the work, as per the guidance
- Turn it in, so it can be reviewed
- Ask when you are stuck — with a question someone can reproduce
- Keep showing up; the change comes from accumulation, not intensity
We work together to build your career in this field. Do not expect a traditional class with slides delivered at you. Expect a class that guides you, mentors you, changes how you work, and helps you build yourself into a cybersecurity researcher.
Syllabus
Three phases across twelve weeks, 33 topics in total. Each topic is taught against work you do and hand in — there is nothing here you watch.
-
A working lab and the fluency to read what it produces: processes, filesystems, Windows event logs, the network from a defender’s side, how a SOC actually operates — and the discipline for handling real data.
Building your analyst lab
- analyst VM build
- Wazuh manager and agent stand-up (sarathg.me/wazuh.html) as your alert source
- Splunk stand-up, following sarathg.me/soc_splunk.html
- a Microsoft Sentinel trial workspace with real logs flowing in
- log source onboarding and coverage check
Processes and services
- process trees and parent–child relationships
- services and scheduled tasks
- what normal looks like before hunting abnormal
Filesystems and artefacts
- artefact locations and paths of interest
- file metadata and timestamps
Windows internals and event logs
- event log channels and the event IDs that matter
- Sysmon basics
- logon types and authentication events
- 4624, 4625, 4688, 4768 and what each actually tells you
Linux and the command line
- grep, awk and sed for log triage
- journald and syslog navigation
Networking for defenders
- TCP/IP, DNS and HTTP from a defender’s view
- east-west versus north-south traffic
How a SOC works
- queue sorted before diving in
- one alert at a time, fully
- supporting evidence gathered before a call is made
- classification rather than guesswork
- acting within your own authority
- documentation written for someone reading it cold
Handling real data, scope and ethics
- handling real data and privacy boundaries
- acting within your authority
- what you never touch, even when you can
-
The analyst’s working day, built on the tools Indian employers actually run: both major SIEMs, endpoint detection, phishing triage, threat intelligence, detections that survive a false-positive pass, and the forensics to answer what happened — all under the SLA clock an L1 really works to.
-
The investigations are done — now make them count. A portfolio and published writeup, a résumé that survives an automated screen, the certification route Indian SOC hiring actually filters on, and interviews rehearsed under real conditions.
Not ready to commit? Start smaller.
Most people should not hand a stranger ₹39,000 on a first visit. There are two cheaper ways in, and both tell you more than a brochure would.
Talk it through
A short call about where you actually are and what you are aiming at. If this is not the right thing for you, you will be told so.
Ask for a callFee and enrolment
₹39,000 as 3 × ₹13,000 monthly — or ₹36,000 paid upfront (₹3,000 off)
Pay in three monthly instalments, or pay the full fee upfront for a discount. The fee line above states both.
Session hours are set per student when your plan is written, and can be adjusted as you go — your invoices follow whatever is agreed.
Terms, in plain words
- The price is on this page. There is no counselling call you have to sit through to find out what it costs.
- Everything needed is included — labs, materials, reviews and the certificate. Third-party exam fees, if you choose to sit one, are yours and are named upfront.
- Pay monthly or upfront. Nothing is charged when you apply.
- If it is not working, say so. Unused sessions are refundable pro rata — the hour ledger in your portal shows exactly what has been used.
- 01
Apply
A short form. No account, no payment. I read every one personally and reply within two working days.
- 02
A call
We talk about where you are, what you are aiming at, and whether this is the right thing for you. If it is not, I will say so.
- 03
A plan tailored to you
A written plan for your goal — the skills it breaks into, the resources chosen for each one, and the session rhythm and hours that fit your week.
- 04
Start
Sessions are scheduled, the plan goes live in your portal, and the work begins.
Where this points
The roles this programme is built to make you credible for.
- SOC analyst, L1 heading to L2
- Detection engineer
- Incident responder
- Threat monitoring analyst
- Blue team engineer
Who teaches it
Sarath G — Application Security Consultant & Cybersecurity Trainer. One mentor, one student at a time. No teaching assistants, no cohort, no recorded lectures.
- 9+
- years in the field
- 1,600+
- hours of instruction delivered
- 30,000+
- people trained
- 10+
- countries taught in, onsite
Figures as published on sarathg.me. Certifications held: CEH Master · CPENT · LPT Master · CHFI · CEI · ISC2 CC · WAHS.
- Built the labs you will work in — ShopEasy, Pandora and a live Wazuh SOC environment, all hosted free at labs.sarathg.me
- Wrote the curriculum himself: 274 field guides, cheatsheets, assignments, labs and research briefs, tagged to a competency taxonomy
- Author of Certified and Clueless (ISBN 9789360381264), the book behind the DARE framework
- Reviews every submission personally — assignments, labs, reports and writeups, with written feedback, not a score
- Runs the whole engagement in the open: a written plan, per-skill progress, and a visible hour ledger you can check
What this is not
- No job guarantee, and no "placement assistance" that turns out to mean a resume template
- No recorded video library sold as live teaching
- No batch of thirty with a teaching assistant answering your questions
- No counselling call before you are told the price — it is on this page
- No certificate from me. You leave with work you can show, and a route to third-party exams that employers actually recognise
Questions
Apply for SOC Analyst (Splunk & Sentinel)
A short form — no account, no payment. Read personally, answered within two working days.
Also available
- Web Application Security Practitioner ₹39,000 as 3 × ₹13,000 monthly — or ₹36,000 paid upfront (₹3,000 off)
- Monthly 1:1 mentorship (open-ended) ₹15,000 per month