INC-001P2 · HIGH
Phishing & Business Email Compromise
Trace credential theft via MDO alerts, analyze headers, and contain compromised mailboxes before lateral movement begins.
MDOSentinelKQL
NEXT COHORT ENROLLING
Launch your SOC career.
Train with real enterprise tools. Work real incidents. Graduate with a portfolio employers can evaluate on day one.
Live mentorship · Fortune 500–grade lab environments
soc-console — analyst@cyberprime LIVE
KQL · sentinel-detections.kql
SecurityEvent | where EventID == 4769 | summarize requests=count() by Account | where requests > 50▌
● ingest 4.2k eps● queue 7latency 38ms
// Next cohortENROLLING
Cohort 1
- Starts
- Aug 19, 2026
- Ends
- Dec 9, 2026
- Enrollment deadline
- Aug 26, 2026
- Price per student
- $2,500
15 seats remaining10/25 filled
0%+
Hired within 90 days of graduation
0
Portfolio incidents completed & documented
$0K
Average starting salary · 2025 cohort
// Your tech stack
Train on the tools SOC teams use daily
No toy labs. You'll investigate, triage, and respond using the same platforms deployed in Fortune 500 security operations centers.
MI
Microsoft Sentinel
Cloud-native SIEM for intelligent security analytics and threat intelligence.
CR
CrowdStrike
Next-gen endpoint protection, threat intelligence, and response.
MD
MDE
Microsoft Defender for Endpoint — enterprise endpoint security.
MD
MDI
Microsoft Defender for Identity — detect and investigate advanced threats.
MD
MDO
Microsoft Defender for Office 365 — safeguard email and collaboration.
SE
ServiceNow
IT Service Management to track, triage, and resolve incidents.
KQ
KQL
Kusto Query Language — analyze vast amounts of security data in Sentinel.
FQ
FQL
Falcon Query Language — advanced threat hunting in CrowdStrike.
SO
SOAR
Automate repetitive tasks and orchestrate response playbooks.
// 16-week program
Four phases. One career.
Each phase builds on the last — from SOC fundamentals to leading live incidents and executing your capstone shift.
01
Weeks 1–3
SOC Foundations
Orient yourself inside a production SOC. Master alert triage workflows, platform navigation, and incident classification before touching a live case.
- Alert triage & SLA workflows
- Sentinel navigation & log sources
- Incident classification & severity scoring
- SOC tooling orientation
- Documentation standards
// Hands-on curriculum
Incidents you'll investigate
Every module ends with a documented investigation — building the portfolio that gets you past the HR screen and into the technical interview.
INC-002P1 · CRITICAL
Identity attacks · Kerberoasting, DCSync
Detect anomalous Kerberos activity in Sentinel, correlate with MDI signals, and execute identity containment playbooks.
SentinelMDIKQL
INC-003P2 · HIGH
Malware & process injection
Hunt living-off-the-land techniques using MDE advanced hunting queries and CrowdStrike Falcon telemetry.
MDECrowdStrikeFQL
INC-004P1 · CRITICAL
Ransomware response & CISO briefing
Lead end-to-end containment, draft executive communications, and present findings in a simulated board-level briefing.
SentinelMDESOAR
INC-013CAPSTONE
Live SOC shift simulation
Operate a full 8-hour shift: triage the queue, escalate P1s, write KQL detections, and hand off to the next analyst.
SentinelKQLServiceNowSOAR
// Investment
One program. One price.
$2,500
Total tuition · $500 deposit to enroll
- All lab environments & enterprise tooling
- Mentor office hours, live each week
- Lifetime alumni community access
$500 deposit on approval · two $1,000 installments after the cohort begins
Book a 1-on-1 Discovery Call
Schedule a 30-minute call with an admissions advisor. We'll walk you through the program and how it can help you become a SOC analyst.
Opens Calendly · 30 min · No account needed
// Questions
Need more information?
Ask us anything about the program, cohorts, or admissions — we'll get back to you within 48 hours.