Certified SOC Analyst (C|SA) Training – EC-Council
Certified SOC Analyst prepares you for the day-to-day work of a security operations centre: collecting and correlating logs, detecting and triaging alerts, hunting threats and escalating incidents. Built for tier 1 to tier 3 analysts, it relies on 50 official labs that mirror real SOC workflows. We deliver it live online, in person in Casablanca or on-site at your organization, in French or English.
The essentials
Publisher : EC-Council
Certification : Certified SOC Analyst (C|SA)
Exam code : 312-39
Duration : 3 days (21 h)
Level : Beginner to intermediate
Formats : Live virtual class · In-person in Casablanca · On-site (intra-company)
Languages : French or English
Exam facts : 100 MCQs · 3 h · pass mark 70%
Exam voucher: included or optional depending on the package — contact us.
Understand how a SOC is organised, staffed and run
Link threats, indicators of compromise and attack methods
Centralise and normalise logs in a SIEM
Detect, qualify and prioritise incidents
Run proactive threat hunts
Coordinate response, forensic investigation and malware analysis
Extend monitoring to cloud environments
Program
Security operations and management
SOC models, roles and performance metrics
Cyber threats, IoCs and attack methodology
Network, application and endpoint attacks
Kill chain and indicators
Log management
Windows, Linux, firewall and proxy sources
Collection and centralisation
Incident detection and triage
SIEM correlation rules
Reducing false positives
Proactive threat detection
Threat hunting and threat intelligence
Incident response
Escalation, containment and coordination
Forensic investigation and malware analysis
First-level analysis for the SOC analyst
SOC for cloud environments
Monitoring AWS, Azure and GCP workloads
Prerequisites
Networking concepts and the TCP/IP suite
Familiarity with security technologies such as firewalls and IDS/IPS
Basic knowledge of common cyber threats
Target audience
Current and aspiring tier 1, 2 and 3 SOC analysts
Network and security administrators moving into a SOC role
Recent cybersecurity graduates looking for a first operational job
Leads of monitoring and detection teams
The exam
The C|SA exam (312-39) consists of 100 multiple-choice questions to complete in 3 hours, with a fixed pass mark of 70%. Questions draw on all eight modules, from SOC organisation and log management to cloud monitoring. Exam delivery options and renewal rules are set by EC-Council, and we explain them in detail when you enrol.
Preparation tips
Learn to recognise the most common Windows event IDs
Write a few correlation rules yourself in the lab SIEM
Practise justifying each triage decision in a single sentence
Frequently asked questions (FAQ)
Is C|SA suitable for beginners?
Yes, as long as you know networking basics and common security technologies. The certification explicitly targets entry-level and intermediate SOC roles, which makes it a good first step into analyst work.
Which SIEM is used?
The official labs rely on market tools, and the principles apply to any SIEM. For on-site sessions we can illustrate the course with the tool your team uses.
What is the pass mark?
You need at least 70% across the 100 questions, answered within 3 hours. The pass mark is fixed, unlike some other EC-Council exams where the cut score varies by exam form.
C|SA or E|CIH: which comes first?
Start with C|SA to build detection and triage skills, then move on to E|CIH for end-to-end incident handling. Together they cover the full path from the first alert to the post-incident review.
How many labs are included?
EC-Council lists 50 labs that reproduce real SOC situations, from log collection and correlation through to cloud monitoring, so you practise each step rather than just reading about it.