SOC Analyst — Tier 3
Building on the SOC Analyst - Tier 1 and Tier 2 learning paths, these four courses guide you through writing custom detection logic, enriching log queries, building analytical notebooks, and identifying vulnerable cloud resources. Engage in hands-on practice within live demo environments to gain experience analyzing real-time data using a free Datadog trial account.
This path is designed specifically for Tier 3 SOC Analysts and other roles responsible for advanced threat analysis, custom detection logic, and proactive security posture management.
You’ll learn how to do the following:
Write Custom Cloud SIEM Detection Rules
Create custom detection rules for Datadog Cloud SIEM. Write detection rule queries using key log attributes and create notification rules to automatically alert stakeholders. Write suppression queries and manage detection rules as code.
Enhance Log Querying and Analytics with Reference Tables, Subqueries, and Calculated Fields
Combine metadata with your logs using Reference Tables. Filter one set of logs against another set of logs using Subqueries. Create new fields using existing tags and attributes at query time using Calculated Fields.
Log Analytics with Notebooks
Learn how to use reference tables, transformation cells, and SQL queries in Datadog Notebooks to investigate log data. Join data from multiple sources to analyze suspicious IP activity and calculate the business impact of failed transactions.
Find and Remediate Vulnerable Cloud Resources with Cloud Security Misconfigurations
Secure your cloud environments with Datadog Cloud Security. Learn how to deploy and configure misconfiguration scanning across your entire cloud infrastructure. Use Compliance to assess your security posture against industry-standard frameworks.
