Skip to content
EDWartens UK

Free course · Cybersecurity

SOC Analyst Level 2: Threat Hunting with Wazuh

Level 2 SOC skills in a free, open source lab: build a Wazuh 4.14 server, enrol Windows and Linux agents with Sysmon, write and tune detection rules, map them to MITRE ATT&CK, hunt persistence, credential access and lateral movement, handle incidents with NIST SP 800-61 Rev. 3, and measure your detections against an Atomic Red Team simulation in an isolated lab.

See the modules

Free to learn. Verifiable certificate £19 when you pass the final exam (optional, VAT included).

Level
Intermediate
Modules
14
Video
20 hours
Price
Free

Outcome

What you will be able to do

Explain how Level 2 work differs from Level 1 triage; deploy a Wazuh server and enrol Windows and Linux agents; configure Sysmon for hunting; write custom decoders and test events with wazuh-logtest; write, test and tune Wazuh rules with sensible levels, correlation and narrow exceptions; tag detections with MITRE ATT&CK v19 and measure coverage; run and record hypothesis-driven hunts for persistence, LSASS access and lateral movement; use file integrity monitoring, vulnerability detection and active response safely; handle an incident on the NIST SP 800-61 Rev. 3 model and write the report; and score detection coverage with an Atomic Red Team simulation in your own isolated lab.

  • Know what Level 2 SOC work adds to Level 1 triage, and build a safe, isolated hunting lab
  • Install Wazuh 4.14, enrol Windows and Linux agents and troubleshoot them
  • Configure and tune Sysmon for the events hunters rely on
  • Write decoders and custom Wazuh rules with correlation, levels and narrow exceptions
  • Tag detections with MITRE ATT&CK v19 and measure coverage in Navigator
  • Run hypothesis-driven hunts for persistence, LSASS access and lateral movement
  • Use file integrity monitoring, vulnerability detection and active response safely
  • Handle and report incidents with NIST SP 800-61 Rev. 3, and score detections against an Atomic Red Team simulation

Software

Wazuh 4.14 (free and open source), Microsoft Sysmon (free), Atomic Red Team with Invoke-AtomicRedTeam (free, lab use only), MITRE ATT&CK Navigator (free, in the browser), a Windows 11 evaluation VM, Ubuntu Server, and VirtualBox or Docker.

Hardware

A computer with 16 GB of RAM and about 150 GB of free disk for the Wazuh server and two small VMs, or a free-tier cloud account kept private to you. The lab must stay isolated from any work or third-party network.

Syllabus

14 modules

Each module has video lessons, notes and a short quiz. The final exam closes the course.

  1. 1From L1 triage to L2 hunting: the job and the lab plan3 lessons
  2. 2Wazuh architecture and a working server2 lessons
  3. 3Enrolling Windows and Linux agents, with Sysmon2 lessons
  4. 4Sysmon configuration for hunting3 lessons
  5. 5Telemetry, decoders and reading events in Wazuh2 lessons
  6. 6Detection rules: writing, testing and tuning3 lessons
  7. 7MITRE ATT&CK for detection coverage3 lessons
  8. 8Hypothesis-driven threat hunting2 lessons
  9. 9Hunting persistence and credential access4 lessons
  10. 10Hunting lateral movement and account misuse3 lessons
  11. 11File integrity monitoring, vulnerability detection and active response3 lessons
  12. 12Incident handling with NIST SP 800-61r3, reports and metrics5 lessonsLab
  13. 13Capstone: hunt across an Atomic Red Team simulation3 lessons
  14. 14Final Assessment1 lesson

How it works

How this course works

  1. Watch the video lessonsOne module at a time, at your own pace.
  2. Take the module quizA short quiz at the end of each module shows what stuck.
  3. Keep your notesWrite in My notes beside each module and ask the trainer if you are stuck.
  4. Practise in the labOptionalTry a task from the module in the EDWartens Lab, in your browser.
  5. Sit the final examPass it once you have been through the modules.
  6. Certificate, if you want oneOptionalPaid, and only after you pass. Anyone can check it online.

EDWartens Lab

Practise this in the EDWartens Lab

Practise the incident handling decisions of a Level 2 analyst in the OT security lab: contain, keep evidence and recover in the right order. Wazuh and Sysmon are not part of the lab.

Works alongside SOC Analyst Level 2: Threat Hunting with Wazuh. The Lab is ot security practice in your browser: no install, no hardware, free to use. Sign in as a learner and it opens with your account.

Open the free lab See the Lab
OT security: Defend a plant network.

Levels to try with this course

Optional. Skip it whenever you like: it never blocks your progress or your certificate.

Why practise in a lab

Technical work is judged on what you can do: wiring, commissioning, finding a fault. Doing a task yourself teaches more than watching it a second time, and a lab lets you try it safely before you meet real equipment. It does not replace working on real hardware.

  • Practise safely, so a mistake costs nothing.
  • The lab checks your work like a site test, so you know when it is right.
  • Free, in your browser, with nothing to install.

Certificate

An optional certificate when you pass

Learning is free. Pass the final exam and you can have a certificate for £19, including VAT, with a number employers can check online. It records that you completed a free online course; it is not a regulated qualification or a CPD certificate.

  • Your name, the course, its study time and your final exam score
  • A unique certificate number and a QR code to its verification page
  • Issued by Wartens Ltd; add it to your LinkedIn profile in one click
  • Pay now or after you pass: it is issued the moment you pass the final

How the certificate works

Sample certificate for SOC Analyst Level 2: Threat Hunting with Wazuh

Credits

Who made the lessons

The video lessons belong to their creators. EDWartens wrote the study plan, notes, quizzes and the final exam.

  • MyDFIR

    Wazuh 101, the seven-part Build a SOC Lab with Wazuh series (server, agents and Sysmon, telemetry, dashboard, file integrity monitoring and rules, active response, the investigation), the Sysmon installation tutorial and a real account compromise investigation

  • Wazuh

    the project's own webinars on detection as code and on simulating attacks with Atomic Red Team and analysing them with Wazuh and Sysmon

  • John Hammond

    detection engineering with Wazuh and testing defences with Atomic Red Team

  • Insane Cyber

    writing Sysmon rules and hunting Run key persistence, malicious scheduled tasks, malicious account use and network share use in Windows logs

  • Anvilogic

    detection engineering with MITRE ATT&CK and lateral movement in Windows networks

  • HackerSploit

    mapping threat group techniques with MITRE ATT&CK Navigator

  • Prabh Nair

    practical threat hunting with Sysmon and MITRE ATT&CK

  • Mohd Maaz

    Sysmon event IDs 1, 3, 10, 17 and 18 for blue team detection

  • Christian Lempa

    deploying Wazuh with Docker in a home lab

  • Taylor Walton

    building custom Wazuh decoders

  • Misk Samater

    Wazuh vulnerability detection and configuration assessment

  • Red Canary

    what Atomic Red Team is and how security teams use it

  • RJC

    the differences between Tier 1, Tier 2 and Tier 3 SOC analysts

  • Tech with Jono

    the path from beginner to Level 3 SOC analyst

  • SecGen

    a Wazuh detection engineering lab writing SSH attack detection rules

  • InfoSec Pandey

    mapping detection rules to MITRE ATT&CK

  • ANOMALI

    hypothesis-led threat hunting

  • p1p0

    detecting credential dumping from Mimikatz to the SIEM

  • HyperQube

    credential dumping analysis, detection and prevention

  • Karissa Ehman

    cyber incident response and the updates in NIST SP 800-61 Rev. 3

  • Security BSides London

    Han O'Connor's talk on investigation note-taking and report writing for SOC analysts

Questions

About this course

What is a SOC Analyst Level 2 and what does this course teach?
A Level 2 SOC analyst takes escalated alerts from Level 1, works out how far an attack reaches, recommends containment, hunts for activity no rule has caught and writes or tunes detections. This course teaches that work hands-on with Wazuh, Sysmon and MITRE ATT&CK, from building the lab to writing an incident report.
Who is this Wazuh threat hunting course for, and what do I need first?
It is for Level 1 SOC analysts, IT and network administrators and security graduates who already triage alerts and can read Windows event logs. You should be comfortable with the Linux command line, basic networking and virtual machines; SOC Analyst Level 1 with Splunk on EDWartens covers the foundations.
Is Wazuh free, and what software does the course use?
Yes, Wazuh is free and open source, and so is everything else the course needs: Microsoft Sysmon, Atomic Red Team, MITRE ATT&CK Navigator, Ubuntu, a Windows 11 evaluation VM and VirtualBox or Docker. The course uses Wazuh 4.14, the current release line in October 2026.
Is the lab safe and legal?
Yes, provided you follow the course rules: everything runs on virtual machines you own, on a network with no route to your employer's or anyone else's systems, and attack simulations with Atomic Red Team run only inside that isolated lab from a snapshot you revert afterwards. The course never asks you to test a system you do not own.
How long does the course take, and is it free to learn?
It takes about 20 hours at your own pace, of which about 14 hours is video, plus about 12 hours for the optional project. Every module, the notes, the 156 practice questions, the project and the final assessment are free to learn.
What certificate do I get, and how is it verified?
You get an EDWartens verifiable certificate of completion when you finish the modules and pass the 15-question final at 60 percent. It carries a unique certificate number and a QR code that open a public verification page showing the course, the modules covered and your final score.
Which frameworks and standards does the course follow?
Detections are mapped to MITRE ATT&CK v19, including the April 2026 split of Defense Evasion into Stealth and Defense Impairment, and incident handling follows NIST SP 800-61 Rev. 3, which builds incident response on the six CSF 2.0 Functions. The course is not affiliated with Wazuh Inc., MITRE, NIST or Red Canary.
What jobs can this course lead to?
It prepares you for SOC analyst Level 2, threat hunter, detection engineer and incident responder roles, and for SOC work at managed security providers that run Wazuh for their clients. Managed security providers, banks, telecoms and IT services firms run 24x7 SOCs and look for analysts who can show hands-on hunting and detection work, such as the project in this course.

The Professional Module is five live days of Siemens PLC, HMI and SCADA with an instructor, then a resume session and a CPD certificate.

See the Professional Module