Cybersecurity Foundations
Triage and Investigate Like a SOC Analyst
By Day 5: Triage a queue of alerts, investigate one true positive end to end and produce an incident report with evidence and recommended containment.
Cybersecurity Foundations is a five-day live online WorkReady Capability Sprint for freshers and IT/support learners aiming for SOC analyst, security operations or IT security roles. Days 1–4 are 90-minute sessions and Day 5 is a 2–3 hour Capability Showcase; the complete Sprint costs ₹2,000.
- ₹2,000
- Complete 5-day Sprint
- Days 1–4
- 90 min/day live
- Day 5
- 2–3 hr Capability Showcase
Paid professional capability development. Not a job or placement service.
At a glance
- Who it's for
- Freshers and IT/support learners aiming for SOC analyst, security operations or IT security roles.
- Entry level
- Fit check: basic networking (IP, ports, DNS, HTTP) and operating-system familiarity. Fit check — a short (10–15 min) readiness task before payment confirmation. Learners who are not ready are routed to a feeder Sprint, not admitted with hidden homework.
- Format
- Online · a focused five-day live online studio
- Duration and schedule
- Days 1–4 are 90-minute live sessions. Day 5 is an extended 2–3 hour Capability Showcase.
- What you produce
- Triage sheet + incident report
- Fees
- ₹2,000 for the complete 5-day Sprint
- What it is not
- Defensive analysis only. Not an offensive/ethical-hacking course and not certification preparation. Not a job or placement service. SkillsNCR does not guarantee employment, placement, salary or interview outcomes.
Learners know attack names and tools but cannot read a log, separate false positives from real incidents, or write an escalation a senior can act on.
Practise the core work of an entry-level security analyst: triage alerts, investigate with logs, decide severity, escalate and document.
Your five days, day by day
Days 1–4 are 90-minute live sessions. Day 5 is an extended 2–3 hour Capability Showcase. Open each day to see what you do and what you leave with.
Day 1The SOC job and the alert queue90 min
- Alert → triage → investigate → escalate → close
- Severity and priority; false positive vs true positive
- Baseline: triage 10 alerts with only intuition
You leave the day with: Baseline triage sheet
Day 2Reading logs90 min
- Authentication, firewall, web, endpoint and email logs
- Timelines and pivoting on IP/user/host
You leave the day with: Investigation notes for 3 alerts
Day 3Phishing and identity attacks90 min
- Analyse a phishing email (headers, links, attachments safely)
- Brute force / impossible travel / suspicious login patterns
- Map to ATT&CK techniques
You leave the day with: Phishing analysis + identity incident notes
Day 4Incident report and escalation90 min
- Scope, impact, evidence, timeline
- Containment recommendations; what not to do
- Write for a senior analyst and for a manager
- Human review and revision
You leave the day with: Incident report v2
Day 5Capability Showcase2–3 hr
Changed-case challenge: Reviewer escalates one alert into a multi-stage incident
- Triage a fresh alert queue under time limit
- Learner investigates, updates severity and briefs the "incident lead"
You leave the day with: Final proof pack, submitted after the changed-case challenge
Tools you work with
- Free SIEM/lab environment (e.g. Splunk free / Elastic / Wazuh lab or supplied log exports)
- VirusTotal / AbuseIPDB-style lookups
- MITRE ATT&CK for mapping
Tool names describe what is used in the Sprint. No vendor endorsement, certification or licence is implied.
Triage sheet + incident report
This is the work you explain, question and adapt in the Day 5 Capability Showcase.
Your proof pack
- 01Baseline vs final triage sheet
- 02Log investigation notes
- 03Phishing analysis
- 04ATT&CK mapping
- 05Incident report
- 06Day 5 briefing
What a reviewer checks
- Evidence-based true/false positive decisions
- Accurate timeline
- Severity justified
- Escalation is clear and actionable
- No unsafe handling of malicious artefacts
Your work has to survive a changed case.
On Day 5 you present the work, explain key decisions, identify limitations and respond when part of the case changes. The final proof pack is submitted after that challenge.
- Present
Walk the reviewer through the work and the decisions behind it.
- Question
Answer challenges on evidence, assumptions and risk.
- Adapt
Reviewer escalates one alert into a multi-stage incident
- Defend
Submit the final proof pack and explain what changed and why.
₹2,000for the complete 5-day Capability Sprint
- Days 1–4
- Live Sprint sessions · 90 minutes/day
- Day 5
- Extended Capability Showcase · 2–3 hours
Paid professional capability development. Not a job or placement service.
Included in the Sprint
- An applied professional case
- Human review and feedback
- Revision after feedback
- A Day 5 changed-case challenge
- A final proof pack: Triage sheet + incident report
Questions worth asking.
Is a Capability Sprint just a short course?
No. It is a focused live capability studio built around doing one bounded kind of professional work, receiving feedback, revising it and demonstrating what you can do.
Will this make me a SOC analyst?
No. The Sprint builds one bounded capability: triage a queue of alerts, investigate one true positive end to end and produce an incident report with evidence and recommended containment. Defensive analysis only. Not an offensive/ethical-hacking course and not certification preparation. SkillsNCR does not promise a role, job or placement.
Do I need prior experience?
Fit check: basic networking (IP, ports, DNS, HTTP) and operating-system familiarity. Fit check — a short (10–15 min) readiness task before payment confirmation. Learners who are not ready are routed to a feeder Sprint, not admitted with hidden homework.
What will I produce?
Baseline vs final triage sheet, Log investigation notes, Phishing analysis, ATT&CK mapping, Incident report, Day 5 briefing.
What does a Sprint cost?
₹2,000 for the complete five-day Sprint.
How long is it?
Days 1–4 are 90-minute live sessions. Day 5 is an extended 2–3 hour Capability Showcase.
When is the next cohort?
This Sprint is opening soon. It opens once enough learners join the waitlist — join it on WhatsApp and you will hear when a cohort is confirmed.
Can I join only one Sprint?
Yes. Each Sprint is designed to provide standalone value.
Does this guarantee a job or placement?
No. WorkReady is paid professional capability development, not a job or placement service. SkillsNCR does not guarantee employment, placement, salary or interview outcomes.
Join the waitlist for Cybersecurity Foundations.
Paid professional capability development. Not a job or placement service.