SOC Investigation
Cohort
The current cohort is officially full. Thank you to everyone who applied.
Each cohort spends six weeks working through investigations, writing reports, and defending their conclusions, with me reviewing their work and giving feedback along the way.
If you were hoping to join and missed it, I’d love to have you in the next one. If you like, you can go ahead and join the waitlist, and you’ll be the first to know when enrollment opens again.
It only takes about 30 seconds, and there’s no commitment.
I keep each cohort small on purpose. That way I can personally review your work, ask you questions about your reasoning, and give you feedback that actually helps you grow. The trade-off is that seats fill up quickly.
I haven’t set the dates for the next cohort yet, but the waitlist will be the first to hear about them.
Investigate
Work through investigations where you decide what to do next.
Get Feedback
Direct feedback on your reasoning, scope, findings, and conclusions.
Write Reports
Turn your investigation into a clear, defensible report.
Defend Your Thinking
Explain each decision and the evidence behind your conclusion.
"Walk me through how you would investigate this."
When that moment comes, can you show how you think?
You cannot control how difficult the job market is, or who else is in the room.
You can control how prepared you are when someone finally gives you the opportunity.
- Explain your thought process clearly
- Know what you are trying to determine
- Identify the evidence that matters
- Pivot when the evidence changes
- Scope beyond the original alert
- Write and defend your conclusions
The Investigation Gap
You have learned cybersecurity. Now can you show how you investigate?
Before
- "Where do I even start?"
- "What should I investigate next?"
- "I think this is malicious."
- "I hope they do not question me."
- "Do I actually know how to do this?"
After
- "Here is what I am trying to determine first."
- "Here is the question I need to answer next."
- "Here is my conclusion and the evidence supporting it."
- "I can explain why I made each decision."
- "Give me the scenario. I will walk you through it."
Stop Trying To Figure This Out Alone
You do not need another list of things to study.
- The environment is ready.You do not need to build another lab before you can practice.
- The deadlines are set.You know exactly what you need to work on each week.
- Your work gets reviewed.You do not have to wonder whether you missed something.
- Your reasoning gets challenged.You find the gaps before an interviewer or a senior analyst does.
I remove the unnecessary friction. You focus on the investigation.
The MYDFIR Method
Everything in the cohort comes back to the same three responsibilities.
Follow the evidence
Set the objective, ask the right questions, follow the evidence, scope what happened, and reach a conclusion the evidence supports.
Explain what happened
Turn the investigation into a clear account of what happened, what you concluded, what you cannot conclude, and why it matters.
Stand behind it
Explain your decisions, answer questions about your scope and evidence, and stand behind what the evidence supports.
InvestigateReportDefend
How You Learn It
Every week runs the same way.
Example Investigation
We walk through a realistic case using the investigation framework so you can see how the objective, questions, evidence, pivots, scope, and conclusion fit together.
Guided Investigation
We tackle the alert together in the console. You follow along in your own environment while we decide what questions to answer, where to look next, what to pivot on, and what the evidence supports.
Independent Investigation
You take ownership of a new alert with no walkthrough telling you what comes next. You investigate it yourself, write the report, and defend your conclusion.
ExampleGuidedIndependent
Each week, we walk through the framework, tackle an alert together, then you apply it independently. As the cohort progresses I expect more from your reasoning and give you less to lean on.
Across six weeks you will investigate scenarios spanning Email, Endpoint, Identity, Active Directory, Cloud, Linux, and more.
You will not become a better investigator by only learning how investigations should work.
You will investigate.
You will make decisions.
You will get stuck.
I will challenge your reasoning.
You will get direct feedback.
You will write and defend your findings.
I will expect more from you every week.
The goal is not to memorize the right answer. It is to learn how to find it.
What You'll Get
Realistic Investigation Environment
A purpose-built business environment where the users, systems and telemetry carry across your investigations, with scenarios built to make you investigate instead of follow instructions.
Direct Feedback
Meaningful feedback on your reasoning, scope, evidence, reports, and conclusions.
Reporting Practice
Turn findings into clear reports that expose the gaps in your own reasoning.
Challenged Reasoning
Be questioned on what you decided, why you stopped, and what could change your conclusion.
Confidence Through Proof
Confidence from repeatedly proving you can work an investigation, not from being told to feel it.
Work You Can Show
Keep the reports and capstone work you produce so you can speak to your investigation process, decisions, and growth.
From the Community
From members I have trained.
"Working through alerts, building queries, correlating logs, mapping activity to MITRE ATT&CK, and documenting findings has helped me understand how the pieces fit together in an investigation. It has also gotten me a lot better at knowing what to investigate next instead of just staring at a bunch of logs and hoping something jumps out."
Nigel D.MYDFIR Member
"Steven helped me put all this theoretical knowledge and labs together to truly understand what happens behind the hood and how to build an investigation."
David G."I didn't know how to triage or investigate an alert before. Now I'm fairly confident triaging and investigating an alert using Splunk or Sentinel and providing a report."
Srinivas G.
I built the investigation training I wish I had when I started.
I have spent over a decade in cybersecurity, mainly across security operations and DFIR.
When I started as a Tier 1 SOC analyst I got very little training, and I constantly questioned whether I was investigating things correctly.
I turned down an opportunity to move up because I did not trust my own investigative ability.
Over time I put in the reps, learned from mistakes, trained other analysts, and became someone who could step into a situation and work through the evidence.
This cohort is built around the deliberate practice, scrutiny, and feedback I wish I had early on.
How the Cohort Runs
- Group Size
- Small and capped
- Live Training
- Six weeks
- Schedule
- Weekend live sessions
Wednesday Report Reviews & Defenses - Capstone
- Final week
- Next Cohort
- Dates to be announced
Waitlist hears first - Recordings
- Every Session
Exact dates and session times are set for each cohort. Once I have them, I’ll share them with the waitlist first.
Who This Is For
This may be a fit if
- You are an aspiring or current SOC analyst
- You have already spent time learning cybersecurity fundamentals
- You understand SOC concepts but still question your ability to investigate independently
- You want direct feedback on your actual work
- You are willing to be questioned and challenged
- You are comfortable working an investigation on your own every week
- You are able to invest in a premium hands-on training experience
This is not for you if
- You want a broad beginner cybersecurity bootcamp
- You want passive video training
- You want someone to give you the answer immediately
- You are looking primarily for offensive security training
- You are unwilling to complete investigations and receive critical feedback
- You are looking for free training
Join the Waitlist
I keep every cohort small so I can give each person real feedback, which means seats fill up fast. If you’re interested in the next one, join the waitlist and I’ll make sure you hear about it first.
-
Be the first to know
When the dates for the next cohort are set, I’ll share them with the waitlist before I announce them anywhere else.
-
Early access to apply
You’ll get the opportunity to apply before enrollment opens to everyone else.
-
No pressure
Joining isn’t an application and there’s nothing to pay. When the dates are out, you can decide if the timing is right for you.
Common Questions
Can I still join the current cohort?
Unfortunately not, all of the seats have been filled. I keep each cohort small on purpose so I can personally review everyone’s work, and adding more seats would take away from that. I’d love to have you in the next one though, so I’d recommend joining the waitlist.
When is the next cohort?
I haven’t set the dates yet. Once I do, the waitlist will be the first to know.
Does joining the waitlist commit me to anything?
Not at all. It isn’t an application and there’s nothing to pay. When the dates are announced, you can decide whether the timing works for you.
Will the next cohort be the same?
The core will stay the same: investigate, report, and defend, with direct feedback every week. I’ll be improving it based on what I learn from each cohort, and the schedule may change. I’ll share all the details with the waitlist first.
Is there a guarantee?
The MYDFIR Cohort Value Guarantee
I want you to actually experience the full cohort before deciding whether it delivered value.
To qualify for the Value Guarantee, you must:
- Complete every independent investigation
- Attend at least 3 Feedback Review calls
- Complete and submit the final capstone
If you do all of that and, at the end of the cohort, genuinely feel you did not receive value from the program, I’ll refund your investment.
Show up. Do the work. Get the feedback. Complete the cohort.
If you still feel it wasn’t worth it, I’ll give you your money back.
What time zone are the sessions in?
Sessions are hosted in Eastern Time, typically 9am to 2pm ET, which works comfortably across the Americas, the UK, Europe, Africa and the Middle East.
If you’re in Asia or Oceania, that would be late at night or overnight for you. I haven’t set the schedule for future cohorts yet.
Do I need a certification?
No. What matters is that you have done enough learning that investigation ability is now the thing holding you back.
Do I need a powerful computer or a home lab?
No. All you need is a browser and an internet connection.
I already work in a SOC. Is this still worth it?
It can be. Plenty of working analysts can run a process but want to get sharper on scoping, timelines, reporting, and holding their position when someone questions the finding.
What if I miss a session?
Sessions are recorded so you can catch up on the content. Your report review and defense happen live, which is why attendance matters.
Can I add these to my portfolio?
Yes and no. Every investigation you conduct except for the capstone, you may add to your portfolio and share them on LinkedIn!
The interview should not be the first time someone challenges how you investigate.
You cannot control the job market.
You cannot control who else applies.
You cannot control when your next opportunity comes.
You can control how prepared you are when it does.
This cohort is full. If you’d like to be part of it, I’d love to see you on the waitlist.