TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies

Course Overview:

TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies is the big picture overview of a SOC, other courses provide a deep dive into the technologies that a SOC may utilize. This course addresses the internal workings of staff, skills required, required authorizations, internal agreements, and setting appropriate expectation levels of a SOC within budget constraints. A SOC is not a one size fits all, the instructor has decades of security experience and brings to the table opportunities to discuss what can work within constraints. Many organizations are coming to the realization that some level of a SOC is now required and to learn just what decisions need to be made: Out-sourced, In-sourced, budgets, capabilities and many more. Students leave with a worksheet of how to progress when they get back to their organization.

TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies – Is a course that incorporates lecture, demos, and group exercises for standing up a Security Operations Center (SOC). Students learn strategies and resources required to deploy, build, and run Network Security Monitoring (NSM) and work roles and flows for a SOC. No network is bullet proof and when attackers access your network, this course will show you options and resources to build a security net to detect, contain, and control the attacker. Examples on what it takes to architect an NSM solution to identify sophisticated attackers and a response strategy. Properly implemented detection and response technologies is integral to incident response and provides the responders timely information and tools to react to the incident. Effective demonstrations are given of Open Source technologies that build up a SOC, but any software can be used and demonstrations are provided to demonstrate technology families not push a specific solution.

TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies demonstrations utilize a cyber range that gives each student in-depth knowledge of monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls; and software and services to provide orchestrate Incident Response, Intelligence Analysis, and Hunt Operations.

Attendees to TN-542: Establishing a Security Operations Center (SOC) People, Processes, and Technologies class will receive TechNow approved course materials and expert instruction.

Dates/Locations:

No Events

Duration: 2 Days

Course Objective:

Prerequisites:

Students should have an understanding of the security field.

Course Outline:

What threats does my organization care about?
What does a threat look like?
What does a threat look like?
How to present the SOC internally.
Communication with Stakeholders and Executives
People
- Establishing a skill matrix and work roles for SOC members
- Establishing a training path
- Personnel background requirementsProcesses
Processes
- Alignment to standards: NIST, PCI, HIPAA, etc.
- Risk related decision trees
- Playbooks
- Threat Intelligence Integration
Technology – Tool Suites to Support:
- Ethical Hacking
- Network Security Monitoring and SIEM
- Forensics
- Dashboards
- Analysis and Hunting
- Incident Management and Ticketing

Comments

Latest comments from students

Liked the class? Then let everyone know!

Privacy Policy

Effective Date: August 1, 2026

TechNow, Inc. respects the privacy of our students and visitors to our website and is committed to protecting the information entrusted to us.

This Privacy Policy explains what information we collect, how we use it, how we protect it, and the circumstances under which it may be disclosed.

1. Information We Collect

We may collect information necessary to provide and administer our educational courses and related services.

This information may include:

Name
Mailing or billing address
Telephone or mobile phone number
Email address
Course enrollment information
Student account information
Course progress and quiz activity
Information necessary to process course registration and payment
Communications between the student and our organization concerning course administration

We collect only information that is reasonably necessary to operate our courses, administer student accounts, communicate with students, and provide related services.

2. How We Use Student Information

We use student information solely for legitimate business and educational purposes related to the delivery and administration of our courses.

This may include:

Registering students for courses
Creating and maintaining student accounts
Providing access to course materials and quizzes
Communicating course schedules and changes
Sending course reminders and administrative notifications
Communicating logistical information necessary for a course
Communicating urgent or emergency information related to the delivery of a course
Responding to student questions and requests
Administering payments and registrations
Maintaining records necessary to operate our business and educational programs
Providing technical support for our student platform
Protecting the security and integrity of our systems

3. No Sale or Marketing Use of Student Contact Information

We do not sell, rent, lease, or otherwise provide student telephone numbers, mobile phone numbers, email addresses, or other student contact information to third parties for their own marketing, advertising, lead generation, or sales purposes.

We do not use student contact information to conduct unrelated marketing campaigns.

We do not sell or exchange student contact information for leads, affiliate marketing, or other commercial marketing purposes.

Our communications with students are limited to information reasonably related to their enrollment, courses, student accounts, course logistics, and urgent or emergency matters associated with delivering a course.

4. SMS Text Messaging

Student SMS Notifications

We may use SMS text messaging to communicate with students who have student accounts associated with our courses.

We only take registrations over the phone and when asked for a preferred phone number you were asked: “Would you like to receive course-related text messages at this mobile number?” This is to initiate automated communications. Once logged into the TechNow Quiz Platform there is a button at the top of your dashboard “SMS: on“, with a mouse hover text tooltip of “You are currently enrolled to receive SMS notifications about your student account and courses. PRESS TO DISABLE SMS”. If you press the button it becomes “SMS: off“, with a mouse hover text tooltip of “You are currently NOT enrolled to receive SMS notifications about your student account and courses. PRESS TO ENABLE SMS”. Changes of “SMS: off” and “SMS:on” are logged as text messaging Opt-Out and Opt-in.

SMS messages are used for course-related and administrative communications, not marketing or promotional campaigns. Most TechNow communications is through email, SMS is used for time critical and emergency communications.

Examples of SMS communications may include:

Student account notifications
Course enrollment or welcome notifications
Course reminders
Class schedule information
Schedule changes
Class cancellations
Location or logistical information
Instructor or course-related administrative notifications
Urgent or emergency information related to the delivery of a course
Other communications reasonably necessary to administer a student’s participation in a course

We do not use student SMS messaging to send advertising, promotional offers, sales messages, or unrelated marketing communications.

SMS Consent

Students who elect to receive SMS messages authorize TechNow, Inc. to send course-related and administrative text messages to the mobile telephone number provided by the student.

SMS consent is not a condition of purchasing or enrolling in a course.

Message frequency varies depending on course enrollment, account activity, and circumstances requiring course-related communication. Message and data rates may apply.

Opting Out of SMS Messages

Students may disable SMS notifications through the SMS settings available within their student dashboard.

Students may also reply STOP to an SMS message to request that SMS messaging be discontinued.

After an SMS opt-out request is received, our platforms prevent additional SMS messages from being sent to that telephone number.

A student may request assistance regarding SMS messaging by replying HELP where supported or by contacting us using the contact information provided on our website.

Disabling SMS notifications does not prevent a student from accessing their student account or participating in a course. Students who disable SMS may still receive important information through other available communication methods when necessary.

SMS Information Is Not Sold or Shared for Marketing

We do not sell, rent, or share mobile telephone numbers or SMS consent information with third parties for their own marketing or advertising purposes.

SMS consent information is used solely for administering our student communication program and providing the course-related communications described in this Privacy Policy.

5. TechNow Does NOT Share Information With Service Providers

Unlike most companies, TechNow does not use third-party service providers to operate our business, we are a SELF HOSTED company.

For example, we internally self host:

Website
Student-platform
Email
Information technology and security
Database and infrastructure services

TechNow interacts with a Bank for Payment Processing and with a trusted SMS provider for SMS delivery. A student’s mobile telephone number and message information may be transmitted through our trusted SMS service provider solely to deliver the requested or authorized course-related communication.

6. Course Platform Information

Students may receive an account on our course and quiz platform.

Information associated with a student account may include:

Login credentials
Course enrollment
Quiz and assessment activity
Course progress
Account settings
Communication preferences
SMS preferences

This information is used to provide and administer the student’s courses and account.

7. Payment Information

When payment is required for a course, payment information may be processed through a third-party payment processor.

We do not retain payment-card information on our student quiz platform unless specifically stated otherwise.

Payment processors may collect and process payment information according to their own privacy policies and security practices.

8. Cookies and Technical Information

Our website and student platform may use cookies, session information, logs, and similar technical mechanisms necessary to:

Maintain authenticated sessions
Keep students logged into their accounts
Provide website and application functionality
Maintain security
Detect and prevent unauthorized access
Diagnose technical problems
Improve the reliability of our services

We do not use student contact information for third-party advertising or behavioral marketing.

9. Information Security

We take reasonable administrative, technical, and organizational measures to protect student information against unauthorized access, alteration, disclosure, or destruction.

No method of storing or transmitting information over the Internet can be guaranteed to be completely secure. We therefore cannot guarantee absolute security of information.

10. Retention of Information

We retain student information for as long as reasonably necessary to provide our services, administer courses and student accounts, maintain appropriate business records, comply with legal or regulatory obligations, resolve disputes, and protect our rights and systems.

When information is no longer reasonably necessary for these purposes, we may securely delete or otherwise dispose of it.

11. Children’s Privacy

Our courses and services are intended for the individuals described by our course enrollment requirements. We do not knowingly collect personal information from children in violation of applicable law.

If you believe that a child has provided personal information to us without appropriate authorization, please contact us.

12. Third-Party Websites

Our website may contain links to websites or services operated by third parties.

We are not responsible for the privacy practices, content, or security of third-party websites. We encourage users to review the privacy policies of those websites before providing personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, business practices, or legal requirements.

When we make changes, we will update the Effective Date shown at the beginning of this Privacy Policy.

14. Contact Us

If you have questions about this Privacy Policy, your personal information, or our SMS messaging practices, please contact us:

TechNow Inc.
14117 Jones Maltsberger Rd
San Antonio, TX 53578
210 733-1093
technow-training@technow.com
technow.com

Effective Date: August 1, 2026

Trademark Recognition

(ISC)², CBK, and CISSP are registered marks of the International Information Systems Security Certification Consortium in the United States and other countries.

Access, Excel, Hyper-V, Outlook, Microsoft, SharePoint, Silverlight, SQL Server, Visual Basic, Win32, Windows, Windows PowerShell and Windows Server are registered trademarks of Microsoft Corporation.

Adobe, Acrobat, Flash and Photoshop are registered trademarks of Adobe Systems Incorporated in the United States and/or other countries

Amazon Web Services is a trademark of Amazon.com, Inc.

Android is a trademark of Google Inc.

APMG-International Change Management, The APMG-International Change Management and Swirl Device logo, APMG-International AgilePM and The APMG-International AgilePM and Swirl Device logo are trademarks of The APM Group Limited.

Certified Ethical Hacker (CEH) is a registered trademark of EC-Council.

Cisco is a registered trademark of Cisco Systems Inc.

CMMI® is registered in the U.S. Patent and Trademark Office by Carnegie Mellon University.

IIBA®, the IIBA® logo, BABOK® and Business Analysis Body of Knowledge® are registered trademarks owned by International Institute of Business Analysis. These trademarks are used with express permission of International Institute of Business Analysis.

CAPM, Certified Associate in Project Management (CAPM), PMP, Project Management Professional (PMP), PMI-ACP, PMI Agile Certified Practitioner (PMI-ACP), PMBOK, and the R.E.P. Logo are marks of Project Management Institute, Inc.

CBAP® and CCBA® are registered certification marks owned by International Institute of Business Analysis. These trademarks are used with express permission of International Institute of Business Analysis.

Certified Business Analysis Professional, Certification of Competency in Business Analysis, Endorsed Education Provider, EEP and the EEP logo are trademarks owned by International Institute of Business Analysis. These trademarks are used with express permission of International Institute of Business Analysis.

COBIT is a trademark of ISACA, registered in the U.S. and other countries.

CompTIA A+ and CompTIA Network+ are registered trademarks of the Computing Technology Industry Association, Inc.

CompTIA CASP and CompTIA Cloud Essentials are trademarks of the Computing Technology Industry Association, Inc.

GIAC and associated certifications: GSEC, GPEN, GXPN, GCFW, GCUX, GCWN, GCIA, GREM are registered trademarks of the SANS Institute

Hadoop is a registered trademark of the Apache Software Foundation.

Hibernate is a registered trademark and servicemark of Red Hat, Inc.

iPad, iPhone, Mac and Mac OS are trademarks of Apple Inc., registered in the U.S. and other countries.

ITIL®, PRINCE2® and MSP® are registered trademarks of AXELOS Limited.

JavaScript, JavaServer, JavaServer Pages, Enterprise JavaBeans, MySQL and PL/SQL are trademarks of Oracle Corporation.

Linux is a registered trademark of Linus Torvalds.

Java and Oracle are registered trademarks of Oracle Corporation.

Palo Alto Networks, PAN-OS, App-ID, Content-ID, Url-ID, GlobalProtect, Wildfire, and Panorama are trademarks of Palo Alto Networks, Inc.

"Python" is a registered trademark of the Python Software Foundation, used by Learning Tree International with permission from the Foundation.

Red Hat and Red Hat Enterprise Linux are registered trademarks of Red Hat, Inc. in the United States and other countries.

SANS and associated certifications: GSEC, GPEN, GXPN, GCFW, GCUX, GCWN, GCIA, GREM are registered trademarks of the SANS Institute

SAP Crystal Reports is the registered trademark of SAP AG in Germany and in several other countries.

Scrum Alliance REP^SM is a service mark of Scrum Alliance, Inc. Any unauthorized use is strictly prohibited.

TechNow® is a registered trademark of TechNow Incorporated.

The Swirl logo™ is a trademark of AXELOS Limited.

Transact-SQL is a trademark of Sybase, Inc.

UNIX is a registered trademark of The Open Group.

VMware is a registered trademark of VMware, Inc. in the United States and/or other jurisdictions.

XML is a trademark of MIT, INRIA or Keio on behalf of the World Wide Web Consortium.

TN-765: Automating Administration with Windows Powershell

Course Overview:

This course provides students with the fundamental knowledge and skills to use PowerShell for administering and automating administration of Windows servers. This course provides students the skills to identify and build the command they require to perform a specific task. In addition, students learn how to build scripts to accomplish advanced tasks such as automating repetitive tasks and generating reports. This course provides prerequisite skills supporting a broad range of Microsoft products, including Windows Server, Windows Client, Microsoft Azure, and Microsoft 365. In keeping with that goal, this course will not focus on any one of those products, although Windows Server, which is the common platform for all of those products, will serve as the example for the techniques this course teaches.

Attendees to TN-765: Automating Administration with Windows Powershell will receive TechNow approved course materials and expert instruction.

Date/Locations:

No Events

Course Duration: 5 days

Course Objectives:

Describe the functionality of Windows PowerShell and use it to run and find basic commands
Identify and run cmdlets for server administration
Work with Windows PowerShell pipeline
Describe the techniques Windows PowerShell pipeline uses
Use PSProviders and PSDrives to work with other forms of storage
Query system information by using WMI and CIM
Work with variables, arrays, and hash tables
Write basic scripts in Windows PowerShell
Write advanced scripts in Windows PowerShell
Administer remote computers
Use background jobs and scheduled jobs
Use advanced Windows PowerShell techniques

Course Prerequisites:

Experience with Windows networking technologies and implementation.
Experience with Windows Server administration, maintenance, and troubleshooting.

Comments

Latest comments from students

Liked the class? Then let everyone know!

TN-575: Open Source Network Security Monitoring

Course Overview:

TN-575: Open Source Network Security Monitoring teaches students how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools. No network is bullet proof and when attackers access your network, this course will show you how to build a security net to detect, contain, and control the attacker. Sensitive data can be monitored and deep packet and deep attachment analysis can be achieved. As organizations stand up a Security Operations Center (SOC) the enterprise NSM is the key ingredient to that SOC. This course not only teaches how to implement an NSM technologically, but how to effectively monitor an enterprise operationally. You will learn how to architect an NSM solution: where to deploy your NSM platforms and how to size them, stand-alone or distributed, and integration into packet analysis, interpret evidence, and integrate threat intelligence from external sources to identify sophisticated attackers. A properly implemented NSM is integral to incident response and provides the responders timely information to react to the incident. TN-575: Open Source Network Security Monitoring is a lab intensive environment with a cyber range that gives each student in-depth knowledge and practical experience monitoring live systems to include: Cisco, Windows, Linux, IoT, and Firewalls.

Attendees to TN-575: Open Source Network Security Monitoring class will receive TechNow approved course materials and expert instruction.

This Course is taught utilizing Security Onion or RockNSM as specified by the customer.

Dates/Locations:

No Events

Duration: 5 Days

Course Objective:

The focus of this course is to present a suite of Open Source security products integrated into a highly functional and scalable Network Security Monitoring solution.

Prerequisites:

Students should have a basic understanding of networks, TCP/IP and standard protocols such as DNS, HTTP, etc. Some Linux knowledge/experience is recommended, but not required

Course Outline:

Network Security Monitoring (NSM) Methodology
High Bandwidth Packet Capture Challenges
Installation of Security Onion
- Use Cases (analysis, lab, stand-alone, distributed)
- Resource Requirements
Configuration
- Setup Phase I – Network Configuration
- Setup Phase 2 – Service Configuration
- Evaluation Mode vs. Configuration Mode
- Verifying Services
Security Onion Architecture
- Configuration Files and Folders
- Network Interfaces
- Docker Environment
- Security Onion Containers
Overview of Security Onion Analyst Tools
- Kibana
- CapME
- CyberChef
- Squert
- Sguil
- NetworkMiner
Quick Review of Wireshark and Packet Analysis
- Display and Capture Filters
- Analyze and Statistics Menu Options
- Analysis for Signatures
Analyzing Alerts
- Replaying Traffic
- 3 Primary Interfaces:
  - Squert
  - Sguil
  - Kibana
- Pivoting Between Interfaces
- Pivoting to Full Packet Capture
Snort and Surricata
- Rule Syntax and Construction
- Implementing Custom Rules
- Implementing Whitelists and Blacklists
Hunting
- Using Kibana to Slice and Dice Logs
- Hunting Workflow with Kibana
Bro
- Introduction and Overview
  - Architecture, Commands
- Understanding and Examining Bro Logs
  - Using AWK, sort, uniq, and bro-cut
- Working with traces/PCAPs
- Bro Scripts Overview
  - Loading and Using Scripts
- Bro Frameworks Overview
  - Bro File Analysis Framework FAF
- Using Bro scripts to carve out more than files
RockNSM ( * If Applicable)
- Kafka
  - Installation and Configuration
  - Kafka Messaging
  - Brokers
  - Integration with Bro and FSF
- File Scanning Framework FSF
  - Custom YARA Signatures
  - JSON Trees
  - Sub-Object Recursion
  - Bro and Suricata Integration
Elastic Stack
- Adding new data sources in Logstash
- Enriching data with Logstash
- Automating with Elastalert
- Building new Kibana dashboards
Production Deployment
- Advanced Setup
- Master vs Sensor
- Node Types – Master, Forward, Heavy, Storage
- Command Line Setup with sosetup.conf
- Architectural Recommendations
- Sensor Placement
- Hardening
- Administration
- Maintenance
Tuning
- Using PulledPork to Disable Rules
- BPF’s to Filter Traffic
- Spinning up Additional Snort / Suricata / Bro Workers to Handle Higher Traffic Loads

Comments

Latest comments from students