SOC & SIEM Internship
Train as a SOC analyst in your own lab: Windows and Linux logs, SIEM searches and dashboards, Sysmon, detection rules, alert triage, phishing analysis, MITRE ATT&CK, threat hunting and incident reports.
What you'll work on
- Level 1: Foundations - What a SOC does, Build a home lab, Windows event logs and more
- Level 2: Building real features - Brute-force detection, Suspicious PowerShell, Detection rules as code and more
- Level 3: Professional work and capstone - Full incident simulation, Incident report, Automate a response and more
Full syllabus: all 30 graded tasks
These are the actual tasks the internship portal assigns for this domain. You submit each one with proof (a GitHub link or document) and a mentor reviews it.
Level 1: Foundations (12 tasks)
- What a SOC does. In a repo named soc-internship, explain what a Security Operations Centre does, the L1/L2/L3 analyst roles and the CIA triad, with examples.
- Build a home lab. Set up a lab with VirtualBox or VMware: one Windows VM, one Linux VM and a SIEM VM. Draw the lab network.
- Windows event logs. Find and explain Windows Event IDs 4624, 4625, 4688, 4720 and 1102 in Event Viewer on your lab machine.
- Linux logs. Read /var/log/auth.log (or journalctl) and find failed SSH logins, sudo use and new users. Explain each entry.
- Install a SIEM. Install Wazuh, Splunk Free or Elastic Security in your lab and send logs from both VMs. Show the logs arriving.
- Search logs. Write 10 SIEM searches: failed logins, logins at night, new admin users, PowerShell runs and more. Save the queries.
- Network traffic basics. Capture traffic with Wireshark while browsing and explain DNS, the TCP handshake, HTTP and TLS packets you see.
- Phishing email analysis. Analyse 3 sample phishing emails (from public training sets): headers, sender, links and attachments. Write the warning signs.
- IOC lookups. Check sample IPs, domains and file hashes on VirusTotal and AbuseIPDB and write what each result means.
- MITRE ATT&CK. Map 5 attack techniques (phishing, brute force, PowerShell, persistence, data exfiltration) to MITRE ATT&CK IDs and explain how each is detected.
- Incident ticket. Write an L1 ticket for a brute-force alert: summary, evidence, severity, actions taken and escalation decision.
- Sysmon. Install Sysmon with a community config on the Windows VM and show process creation and network connection events in the SIEM.
Level 2: Building real features (10 tasks)
- Brute-force detection. Run a controlled brute-force (Hydra against your own lab VM only), then build a SIEM alert rule that catches it.
- Suspicious PowerShell. Run harmless encoded PowerShell commands in the lab and write a detection for encoded or download-and-run commands.
- Detection rules as code. Write 5 Sigma rules for your lab detections, convert them for your SIEM and keep them in Git with test notes.
- Dashboards. Build a SOC dashboard: logins by user, failed logins over time, top source IPs and alerts by severity.
- Malware triage. Examine a safe sample from a training set (or the EICAR test file) with hashing, strings and an online sandbox report. Write a short triage note.
- Network detection. Install Suricata or Zeek in your lab, run a port scan with Nmap against your own VM and show the alert.
- Threat intelligence. Add a free threat-intel feed (abuse.ch lists or AlienVault OTX) to your SIEM and alert when a known bad IP appears.
- Alert triage practice. Investigate 10 alerts from a public SOC dataset or Blue Team Labs or LetsDefend free challenges. Mark each true or false positive with reasons.
- Playbook. Write an incident response playbook for a phishing report: steps, tools, who to tell and when to close.
- Reduce false positives. Tune one noisy rule in your SIEM with exclusions or thresholds and show the alert count before and after.
Level 3: Professional work and capstone (8 tasks)
- Full incident simulation. Simulate an attack chain in your lab (phishing file, PowerShell, new user, data copy), detect each step and write a timeline.
- Incident report. Write a professional incident report for the simulation: executive summary, impact, timeline, root cause, IOCs and recommendations.
- Automate a response. Automate one response with a script or SOAR tool (Shuffle or TheHive): for example, block an IP or open a ticket when an alert fires.
- Threat hunting. Form a hypothesis (for example 'an attacker uses scheduled tasks for persistence'), hunt for it in your logs and report the findings.
- Cloud logs. Send logs from a free cloud account (AWS CloudTrail, Azure Activity Log or Google Cloud audit logs) to your SIEM and detect a risky change.
- Metrics and coverage. Measure your SOC lab's MTTD and MTTR from the simulations and show your detection coverage on the ATT&CK matrix.
- Ethics and law. Write a page on legal and ethical rules for SOC work in India: the IT Act, the DPDP Act, CERT-In reporting within 6 hours and testing only with permission.
- Capstone: SOC portfolio. Publish your SOC lab: architecture, 10 or more detections with tests, dashboards, playbooks and one full incident report. Submit the repo and a 2-minute video walkthrough.
Real software work, not just training
Every SOC & SIEM task is reviewed by our team and saved to your portfolio. Interns who pass the readiness check can take real work from Training Trains, W3AppDevelopers and DomainHostly projects on the Company Work board.
Frequently asked questions
Do I need experience to join the SOC & SIEM internship?+
Basic networking and Linux help. A laptop with 16 GB RAM is best for the lab; 8 GB works with smaller VMs. All attacks are run only against your own lab.
What will I do in the SOC & SIEM internship?+
You complete 30 graded tasks in three levels: foundations, real features, and professional work. Each task is submitted with GitHub or document proof and reviewed. The final capstone is: Capstone: SOC portfolio.
Do I get a certificate for the SOC & SIEM internship?+
Yes. After your required tasks are approved, your attendance is above 75% and you pass the proctored final exam, you get a graded completion certificate that anyone can verify at trainingtrains.com/verify.
Can I do the SOC & SIEM internship online?+
Yes. You can do it fully online from home, or offline at our Erode and Perundurai branches. Tasks, quizzes and mentor reviews are the same in both modes.
Available both online (work from home) and offline at our Erode and Perundurai branches - see the full internship program details for departments, duration, and the application process.