SOC103 · Logs, Telemetry and Security Monitoring

Categories: Cybersecurity
Wishlist Share

About Course

Learn which logs and telemetry give real security visibility, how to collect and normalize them, and how to build a monitoring view in a free SIEM.

Build · 6 hours · 4 lessons, a lab, an assessed assignment and a portfolio piece

Who it is for

IT professionals and junior analysts who will set up or operate security monitoring for a small or mid-sized organization.

Prerequisites

Complete SOC102 or have equivalent networking and Linux command-line skills.

What you will be able to do

  • Select log sources by risk and map each to the questions it answers
  • Deploy a Wazuh single-node stack with Docker Desktop and enroll Windows or Linux agents
  • Normalize events into consistent fields and explain why schemas such as ECS matter
  • Build a monitoring dashboard and a daily review routine with clear thresholds

Lessons

  • Lesson 1 · Choosing log sources that matter
  • Lesson 2 · Collecting and normalizing events
  • Lesson 3 · Dashboards and daily monitoring routines
  • Lesson 4 · Lab and assignment

Lab: Stand up Wazuh and monitor two endpoints

You deploy the Wazuh single-node Docker stack on your computer and enroll at least one endpoint agent. You enable Sysmon on Windows or auditd on Linux, generate harmless test activity such as failed logins and new user creation, and confirm the events arrive, are parsed and appear on a dashboard you build.

Free tools: Docker Desktop, Wazuh single-node (free, open source), a Windows or Ubuntu virtual machine with Sysmon or auditd

Assessed assignment

Write a logging and monitoring plan for a 50-person company that uses Microsoft 365, ten Windows servers and a cloud firewall. Prioritize log sources, define retention periods, list the fields you require from each source and describe your daily and weekly review routine. Include screenshots of your Wazuh dashboard from the lab as proof of concept and estimate daily log volume.

Criterion Weight What excellent work looks like
Log source prioritization 30% Sources are ranked by risk and each is tied to specific detection questions.
Technical accuracy 25% Event IDs, fields, retention and volume estimates are correct and justified.
Lab evidence 25% Screenshots show working ingestion, parsed fields and a purposeful dashboard.
Operational routine 20% Review routines have owners, frequency and thresholds that a small team can sustain.

Portfolio piece

A logging and monitoring plan with a working Wazuh dashboard for a mid-sized company.

Self-paced, 12-month access. Questions are answered in writing through the student panel. A completion record is issued when you finish the course.

Next step

Continue with SOC104 · Threat Intelligence and the MITRE ATT&CK Framework · 6 hours · $42.00

Continue to the next course

Prefer the whole program? Program in Security Operations & Threat Defense · $378.00 (10% less than buying the courses separately)

Show More

What Will You Learn?

  • Select log sources by risk and map each to the questions it answers
  • Deploy a Wazuh single-node stack with Docker Desktop and enroll Windows or Linux agents
  • Normalize events into consistent fields and explain why schemas such as ECS matter
  • Build a monitoring dashboard and a daily review routine with clear thresholds

Course Content

SOC103 · Logs, Telemetry and Security Monitoring (6 h)
Learn which logs and telemetry give real security visibility, how to collect and normalize them, and how to build a monitoring view in a free SIEM.

  • Lesson 1 · Choosing log sources that matter
  • Lesson 2 · Collecting and normalizing events
  • Lesson 3 · Dashboards and daily monitoring routines
  • Lesson 4 · Lab and assignment
  • SOC103 Assessment · Logs, Telemetry and Security Monitoring
Scroll to Top