SOC Investigator Foundations™

01 · Fit

Who this course is for

Who it is for

Aspiring and junior SOC analystsAlso suitable for IT practitioners moving toward security operations.

Prerequisites

No prior SOC role requiredBasic digital literacy, comfort using a web browser and willingness to document reasoning.

02 · Outcomes

Learning objectives

Upon successful completion, learners will be able to:

1. Follow a repeatable SOC investigation workflow from alert intake through closure or escalation.
2. Collect, organize and distinguish observations, evidence, assumptions and conclusions.
3. Use guided KQL-style investigation steps to test questions against controlled evidence.
4. Reconstruct the PakChoi case timeline and defend severity and escalation decisions.
5. Produce a concise investigation record, evidence table and incident briefing.
6. Explain where AI can assist an investigation—and where human validation remains mandatory.

03 · Structure

6-module course outline

1. SOC workflow and incident lifecycleUnderstand investigation stages, analyst responsibilities and the difference between an alert, an event and an incident.
2. Alert triage and evidence handling
3. KQL-guided investigation
4. PakChoi case reconstruction
5. Severity and escalation decisions
6. Final knowledge and practical assessment

04 · Practical experience

Practical experience

• PakChoi case file
• Evidence repository
• Guided KQL exercises
• Incident record template
• AI-use verification ledger

05 · Assessment

Assessment and completion

Assessment

Knowledge checks and a practical investigationModule checks, evidence-handling exercises, the PakChoi case reconstruction and a final knowledge and practical assessment.

Passing requirement

Complete all required modules and activities, submit the required practical work and achieve at least 80% on the final assessment.

Work product

Evidence-backed investigation portfolioA completed investigation record, evidence table, timeline, severity decision and incident briefing.

06 · Study requirements and support

Study requirements and support

Device

Laptop or desktop recommendedA current browser and a stable connection are needed for interactive exercises. Phone access suits readings, not full investigations.

Connectivity

Readings and transcripts support lower-bandwidth study.Interactive exercises need a stable connection and a full-size browser.

Access

90 daysAccess runs for 90 days from enrollment activation.

Accessibility

Captions, transcripts, keyboard operation, downloadable readings and low-bandwidth alternatives.

Support

Technical, enrollment and account-access support by email.The self-paced course does not include individual tutoring or instructor review.

07 · Credential

Certificate

Credential

ManyTek Academy Certificate of CompletionAwarded when the passing requirement is met. The certificate confirms completion of a ManyTek Academy course. It is not professional licensure, an independent industry certification or a guarantee of employment.