SOC109 · Final Project: A Detection and Response Playbook for a Small Business

Categories: Cybersecurity
Wishlist Share

About Course

Bring the whole program together by building a complete detection and response playbook for a realistic small business, from log sources and detections to automation, incident procedures and metrics.

Advance · 8 hours · 4 lessons, a lab, an assessed assignment and a portfolio piece

Who it is for

Learners who have completed the SOC program and want a portfolio-ready capstone that demonstrates end-to-end blue-team skills.

Prerequisites

Complete SOC101 through SOC108; this project reuses your labs from SOC103, SOC105, SOC106, SOC107 and SOC108.

What you will be able to do

  • Assess a small business's assets, threats and logging gaps and define the playbook scope
  • Deliver a tested set of detections mapped to ATT&CK with triage guides
  • Produce response playbooks for the business's top incident scenarios, including one automated workflow
  • Present coverage, metrics and a 90-day improvement roadmap to non-technical leadership

Lessons

  • Lesson 1 · Project brief and scope
  • Lesson 2 · Milestones and method
  • Lesson 3 · Quality checklist and common mistakes
  • Lesson 4 · Deliverables, rubric and submission

Lab: Capstone workspace

You work in your existing lab environment and a single GitHub repository that holds every project file. You choose one of three provided business profiles (a dental clinic, an online retailer or an accounting firm) or describe a comparable fictional business, and you must not use real company data.

Free tools: Your Wazuh or Elastic lab from earlier courses, sigma-cli, ATT&CK Navigator, n8n self-hosted, draw.io and a GitHub free repository

Assessed assignment

Build and submit a detection and response playbook for your chosen small business. It must contain the business profile and scope, a log source plan, at least five tested Sigma detections with an ATT&CK coverage layer, three incident response playbooks (phishing, account takeover and ransomware), one working n8n automation, a vulnerability management summary and an executive briefing of no more than five slides or two pages. Everything must be consistent: every detection should point to a playbook, and every playbook should name its data sources.

Criterion Weight What excellent work looks like
Risk-based scope and coverage 25% Scope, assets and threats are clearly defined, and detections and playbooks address the business's highest risks.
Detection quality and testing 25% Five or more valid Sigma rules with positive and negative tests, ATT&CK mapping and triage guides.
Response playbooks and automation 30% Playbooks are actionable, owned and realistic for a small team; the automation works and has guardrails.
Executive communication 20% The briefing explains coverage, metrics, residual risk and a 90-day roadmap in plain language.

Portfolio piece

A complete, version-controlled detection and response playbook for a small business, with an executive briefing.

Self-paced, 12-month access. Questions are answered in writing through the student panel. A completion record is issued when you finish the course.

Next step

You have reached the final course of this program. Keep growing with a Learning Path that combines this program with related ones.

See Learning Paths

Prefer the whole program? Program in Security Operations & Threat Defense · $378.00 (10% less than buying the courses separately)

Show More

What Will You Learn?

  • Assess a small business's assets, threats and logging gaps and define the playbook scope
  • Deliver a tested set of detections mapped to ATT&CK with triage guides
  • Produce response playbooks for the business's top incident scenarios, including one automated workflow
  • Present coverage, metrics and a 90-day improvement roadmap to non-technical leadership

Course Content

SOC109 · Final Project: A Detection and Response Playbook for a Small Business (8 h)
Bring the whole program together by building a complete detection and response playbook for a realistic small business, from log sources and detections to automation, incident procedures and metrics.

  • Lesson 1 · Project brief and scope
  • Lesson 2 · Milestones and method
  • Lesson 3 · Quality checklist and common mistakes
  • Lesson 4 · Deliverables, rubric and submission
  • SOC109 Assessment · Final Project: A Detection and Response Playbook for a Small Business
Scroll to Top