Operation: Silent Phantom · Career Path

Become a
SOC Analyst

Skill-first learning built on real industry experience: live case studies, hands-on labs, and micro projects that mirror what SOC analysts face on the job from Day 1.

6
Chapters
Ch.00 → Ch.05
35
Story Days
Continuous narrative
44+
Labs
Hands-on terminal
75+
Hours
Of guided content
🖥️ Browser-Based Terminal📖 Guided + Professional Modes🏅 Earn Badges Per Chapter

What You Learn

Skills you build across all six chapters, grounded in real SOC work, not slides.

Detection & Investigation

  • ·Read and triage real SIEM and endpoint logs
  • ·Write KQL detection queries in Microsoft Sentinel
  • ·Identify lateral movement and privilege escalation patterns
  • ·Reconstruct attack timelines from fragmented evidence
  • ·Map attacker behaviour to MITRE ATT&CK techniques

Response & Emerging Threats

  • ·Analyse AI phishing campaigns and deepfake IOCs
  • ·Investigate LLM prompt injection in audit logs
  • ·Use AWS GuardDuty and CloudTrail for cloud forensics
  • ·Execute SOAR playbooks for ransomware containment
  • ·Write board-level incident briefs under time pressure

📖 Student Mode

  • ✓Hints available at each step
  • ✓Warm-up commands provided
  • ✓Full incident brief context
  • ✓No time pressure

🔒 Professional Mode

  • →No hints, figure it out yourself
  • →No warm-up commands
  • →Minimal asset brief only
  • →SLA timer on select labs
⚠ EMPLOYEE BRIEFING · DAY 1TLP:AMBER · New Analyst Onboarding
Your First Day at NoowaPay

Welcome to the SOC

You are a new analyst at NoowaPay Technologies, a Bengaluru fintech processing ₹14 crore in daily transactions. On Day 0, a single SSH anomaly blinks in your queue. Over the next 35 days, you watch and race to stop TA-Phantom systematically breach every layer of the environment.

Each chapter is a real phase of the breach: initial access, lateral movement, privilege escalation, AI-assisted phishing, cloud exfiltration, and ransomware. Every lab uses the actual evidence trail the attacker left behind.

Your Role
SOC Analyst L1
Employer
NoowaPay Technologies
Threat Actor
TA-Phantom
Outcome
524 GB exfiltrated
6
Attack phases
35
Simulated days
3
Attack vectors
0
Easy answers

The Six Chapters

Each chapter covers a distinct phase of the breach. Chapters unlock sequentially as you complete labs.

Ch.00
Orientation

The Analyst Arrives

Day 0

You join the SOC at NoowaPay Technologies, a Bengaluru-based fintech processing ₹14 crore daily. Your analyst seat is live. A single SSH alert blinks at 02:14 IST from an unfamiliar IP. Is it noise, or the first thread of something larger?

Log triageAlert prioritisationLinux basics
▼ TA-Phantom gains initial access
Tool Stack

The Enterprise Tool Stack

Master the exact tools enterprise SOC teams use globally -- inside real lab environments.

Detection & SIEM

Microsoft Sentinel
Microsoft Sentinel
Splunk
Splunk
Azure Log Analytics
Azure Log Analytics
KQL
KQL

Cloud Security

Microsoft Entra ID
Microsoft Entra ID
Amazon GuardDuty
Amazon GuardDuty
AWS CloudTrail
AWS CloudTrail
Microsoft Defender
Microsoft Defender

Endpoint & Forensics

Wireshark
Wireshark
Windows Sysinternals
Windows Sysinternals
Sysmon
Sysmon
YARA
YARA
tshark / GShark
tshark / GShark
DeviceProcessEvents (MDE)
DeviceProcessEvents (MDE)

Threat Intelligence

MITRE ATT&CK
MITRE ATT&CK
MITRE ATLAS
MITRE ATLAS
VirusTotal
VirusTotal
Shodan
Shodan
MISP
MISP
Recorded Future
Recorded Future
CrowdStrike Falcon
CrowdStrike Falcon

Scripting & Automation

Linux / Bash
Linux / Bash
Python
Python
Jupyter Notebooks
Jupyter Notebooks
AWS SDK / Boto3
AWS SDK / Boto3
SOAR (Sentinel Automation)
SOAR (Sentinel Automation)

AI & Adversarial AI

New
Claude (Anthropic)
Claude (Anthropic)Co-analyst
Microsoft Copilot for Security
Microsoft Copilot for SecurityDefend
Gemini
GeminiDefend
OpenAI / ChatGPT
OpenAI / ChatGPTDefend
Slack AI
Slack AIInvestigate
ServiceNow AI
ServiceNow AIInvestigate
UEBA
UEBAInvestigate
Hugging Face
Hugging FaceSupply Chain
WormGPT
WormGPTAdversarial
ElevenLabs
ElevenLabsAdversarial

Learn to use AI as a co-analyst, investigate prompt injection and deepfake attacks, and understand how adversarial AI tools like WormGPT are weaponised against enterprise targets.

🏆 Top 10 Cyber DefendersTrack: soc-core
#NameScoreXPBadgesSpeed
1
2
3
4
5

Sign in to see where you rank

Join thousands of cyber defenders

Enroll

One Course. All 40 Chapters.

Every student gets the full 40-chapter program — from the first SSH alert to the final board debrief. Start wherever your experience level is.

Pricing coming soon

Full course · 47 lessons · 14 micro-projects · CyBe Certified SOC Analyst L1

  • ✓All 6 arcs — First Contact through the Siege
  • ✓Browser-based lab pod per chapter
  • ✓37 AI practicums (Claude + Copilot)
  • ✓72-Hour SOC Siege capstone
  • ✓Blockchain-verified certificate
  • ✓Direct hiring pipeline access
Express Interest →

Where do you start?

I am new to cybersecurity
Start from Chapter 1 — no prior knowledge needed
I know SOC basics
Arc 2 onward — skip the Linux/log fundamentals
I am a working analyst
Arc 3+ — KQL, Sentinel, Detection Engineering, Cloud

All three start the same course — chapters are designed so you can move at your own pace.

Advisory Board

Industry Advisors

CISOsdirectors, and security leaders from across India's top enterprises who shape the curriculum and open hiring pipelines for graduates.

* More active CISOs and Security Directors joining the Board.

Academia Partners

Bridging Campus to Career

Partner colleges integrate CyBe Global into their curriculum, giving students VTU SEC credit, industry internship hours, and a verified certification before graduation.

Madras Engineering College

Madras Engineering College

Chennai, Tamil Nadu

✓ Active Partner

Students earn VTU SEC credit and industry internship hours through the full SOC Analyst program.

🏛️

Expanding Across India

Colleges in discussion for 2025–26

📍 Mysuru · Coming Soon📍 Coimbatore · Coming Soon📍 Vizag · Coming Soon

Is your college interested? Get in touch →

Hiring Industry Partners

Where Our Graduates Go

Companies that hire directly from the CyBe Global talent pool. No cold applications, no resume black holes.

AuthenticOne
AuthenticOne
Aishan Technologies
Aishan Technologies
CyBe Global Pvt Ltd
CyBe Global Pvt Ltd
CSA Bangalore Chapter
CSA Bangalore Chapter
+ More companies under discussion
Past Events

Across India's Campuses

CyBe Global has collaborated with engineering colleges, law schools, and universities across India to bring cybersecurity awareness to students.

VNR VJIET, Hyderabad

VNR VJIET, Hyderabad

CSA Bangalore Chapter · Cloud Security Workshop · March 2024

Regional News Coverage

Regional News Coverage

Telangana · Eenadu, Sakshi, Vaartha, Surya · March 2024

Acharya Institute of Technology

Acharya Institute of Technology

Bangalore · CSA Bangalore Chapter Meetup

Manipal Law School, Bengaluru

Manipal Law School, Bengaluru

Data Privacy Day · Jointly with CSA Bangalore, FDPPI, BSPIN

LJ University, Ahmedabad

LJ University, Ahmedabad

Cloud Security Awareness Workshop

How We Compare

Built Different from Every Competitor

Every platform claims "hands-on." Only one runs a continuous 40-chapter breach storyline with AI as an attack surface, at 1/25th the cost of SANS.

FeatureCyBe AISAYou are hereSANS SEC450EC-Council CSATryHackMeHTB AcademyLetsDefend
Continuous breach storyline✓✗✗✗✗✗
AI as attack surface (taught)5 full arcs✗✗✗✗✗
AI tool hands-on (critical eval)37 practicumsPartial✗✗✗✗
Live terminal labs✓✓✓✓✓✓
Alert queue simulation5 queues✗✗✗✗Core feature
72-hour capstone siege✓1-day CTF✗✗✗✗
Corporate 5-day delivery✓6 days3 days✗✗✗
Self-paced (India-friendly)40 days4 monthsSelf-paced✓✓✓
KQL + Splunk + Sigma + YARAAll 4All 4PartialPartialPartialKQL only
India price (full course)Coming soon~₹5,80,000~₹1,25,000~₹7,000/yr~₹7,000/yr~₹15,000/yr
Blockchain-verified certificate✓✓✓✗✗✗
Industry hiring pipeline✓ Direct✗✗✗✗✗
1/25th
the cost of SANS SEC450
Same skill outcomes, India-first pricing
37
AI practicums
No other course teaches critical AI evaluation
40
chapter continuous story
One breach, six arcs, zero abstraction

Ready to Begin?

Chapter 0 starts the moment you click. No setup, no install. Just you, the terminal, and an attack in progress.

Express Interest →

Browser-based · No downloads required