SOC Analyst in Practice: Detect, Triage and Respond on the Security Operations Floor
Signature Course No. 323 — A Signature AI Socratic Coaching Course.
No experience needed — your coach starts where you are.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's SOC Analyst in Practice: Detect, Triage and Respond on the Security Operations Floor course, in the Risk, Safety & Compliance category. It does not play videos at you. It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room.
A security operations center succeeds or fails on unglamorous work done well at volume. Hundreds of alerts a day, most of them benign, a few of them the first visible edge of something that matters, all of them arriving while the clock runs on the ones already open. This course teaches that work as it is actually done — on a fictional but fully costed floor, Windmere Logistics, whose standing figures (6,200 endpoints, 480 servers, 14 warehouse sites, about 9,600 alerts a month) every concept reasons from and none quietly changes.
It starts with the queue. New analysts imagine the job is incidents; veterans know the job is the queue, the ordered, never-quite-empty list through which incidents are discovered in the first place. You will learn to run a queue instead of being run by it, to read an alert whole — what fired, on what asset, with what enrichment, and what is missing — to set severity and priority you can defend, and to close alerts only on dispositions that mean something a month later.
It works in two movements. First, Module 1 — Triage at Volume: From Alert to Judgment — work through Concepts 1–9, finishing with One Shift, Forty Alerts; then, Module 2 — Detection, Escalation and the Incident: Making the Floor Better While It Runs — work through Concepts 10–18, finishing with The Night the Queue Told the Truth.
Both capstones produce real artifacts — a complete worked shift board for one Windmere evening shift: forty alerts ordered, read, dispositioned, and accounted for, with an escalation packet; and a complete incident handling pack for the night the queue turned loud: timeline, scope, decisions, communications, a reconciled board, and a detection improvement proposal defended in writing.
The honesty standard is part of the course. Nothing here is attack craft, and nothing here is theory without a queue attached: every scenario is defensive floor work — detecting, triaging, escalating, containing with authorization, documenting, and improving detections — and where a step would require authority you do not hold, the course teaches you to stop and escalate, because on a real floor that stop is the job done correctly. The course assumes Security+-level foundations, teaches in product-neutral terms that transfer between consoles, and makes no exam or job guarantee.
The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies. Learners who already know the material can test out concept by concept.
SOC Analyst in Practice: Detect, Triage and Respond on the Security Operations Floor is part of The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning has delivered since 2002.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with the queue itself. Say what decides the order you work your busiest list in — arrival, loudest voice, personal interest, or risk; say what the next person finds when you park a piece of work unfinished — a note with a next step, or a mystery; and name the alerts you would be most tempted to close quickly without depth, and what that temptation risks. Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — One Shift, Forty Alerts for Module 1 and The Night the Queue Told the Truth for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
Evidence before conclusion, at floor speed. Every concept returns to the same habit: state what the evidence shows, state what it does not show, and let the gap between those two sentences decide your next step — never your anxiety, and never the alert's vendor-written title.
Module 1 teaches the floor's core motion. The Queue Is the Job; Know Your Estate; Read an Alert Whole; Severity, Priority and the Clock; Dispositions That Mean Something; Correlation, Duplicates and Parents; Identity and Access Alerts; Endpoint and Malware Alerts; and Network and Exfiltration Alerts — alert in, judgment out, record left behind, repeated at volume without the standard slipping.
Module 2 teaches you to move a case without the judgment leaking out of it. Escalation That Lands First Time; Case Notes and Shift Handover; Investigation on the Floor; Detection Content and the Rule Lifecycle; Tuning Without Blinding; Queue Health and Honest Metrics; SOAR Playbooks and Automation Guardrails; Major Incidents on Real Timelines; and The Learning Loop — between people, between shifts, and between the floor and the whole organization.
And it holds its boundary throughout. This course owns defensive floor operations at working depth; the analyst-thinking foundations it builds on are taught in their own neighboring course, and offensive work belongs to another course entirely and appears nowhere here. Where the question is what to do with the alert in front of you, on the clock that is actually running, you are in the right course.
What you will learn
- Run the queue: work a SIEM/SOAR queue at volume with discipline, clocks, and a defensible order of work
- Triage to a standard: read alerts whole, set severity and priority, and close with dispositions the record can stand on
- Work the alert families: identity, endpoint, and network cases from first alert to correct next step
- Escalate and hand over: pass work between people and shifts so nothing is lost, repeated, or left ownerless
- Improve detection: write, tune, and measure detection content and automation without blinding the floor or automating a bad decision
- Handle incidents on real timelines: scope, support containment with authorization, communicate, and close the learning loop
Everything in the course
- All 18 concepts of SOC Analyst in Practice: Detect, Triage and Respond on the Security Operations Floor, in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: One Shift, Forty Alerts and The Night the Queue Told the Truth
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for the analysts who carry the queue
Tier 1 and Tier 2 SOC analysts in seat — doing queue work now, who want their triage, notes, and escalations to hold up under review; and new SOC hires with foundations in hand who passed the interview on concepts and now face volume, clocks, and a live queue for the first time.
IT and service-desk staff moving into a SOC — whose systems fluency is real but who have never worked alert triage, dispositions, or handovers as a discipline.
SOC team leads, shift leads, and small-team defenders who are the SOC — who need a shared standard for what good triage, a good escalation, and a good handover actually look like, and priority discipline more than enterprise scale. This course assumes foundation-level knowledge of systems, networks, identity, and the stages of an intrusion; it assumes no particular SIEM, SOAR, EDR, or ticketing product, and no authority beyond a working analyst's remit.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with The Queue Is the Job
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
Before you enroll
What is a Socratic coaching session?
A conversation, not a video. Your coach asks a question; you answer — out loud by voice, or by typing — and the coach responds to what you said: naming the misconception it hears, affirming what you got right, and asking the next question. You advance only when you have mastered each concept, so a finished course means the learning held.
How long does it take — and how long do I have?
About 30 minutes per concept. Learn in sittings of any length; your progress is saved as you go. You have a full year from purchase to finish, and you can revisit and retake within that year.
What does the certificate verify?
That you completed every concept and both capstones of this course. Anyone can confirm a Cognosco certificate online — enter its certificate ID on our verification page.
What if it isn't for me — what are the refunds?
If you have not started, cancel for a full refund within seven days of purchase. Once you have started, there is no cash refund — stop before finishing and we credit the full amount you paid toward any other course in the library (credit valid one year from your original purchase). Once you complete the course, no refund or credit applies.
More Signature Courses are coming
SOC Analyst in Practice: Detect, Triage and Respond on the Security Operations Floor is Signature Course No. 323. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.