SOC Analyst Level 1 & 2 Masterclass

Explore the OSI seven-layer model and the four-layer TCP/IP framework, with practical layer mappings, key protocols, and common SOC attack indicators across application, transport, network, and access layers.

Master ports and protocols to speed SOC triage and alert correlation. Understand well-known, registered, and private ports, plus DNS, HTTP/HTTPS, LDAP, SSH, and ICMP to spot anomalies.

Explore data packets, packet inspection, and how Wireshark analyzes headers, payloads, and DNS/HTTP traffic. Learn to identify threats, beaconing, and DNS tunneling using packet sniffers for SOC incident triage.

Explore dns tunneling and dns beaconing: how encoded subdomains transfer data to an attacker-controlled dns server to bypass filters, exfiltrate information, and how malware check-ins maintain persistence.

Understand attack paths from infiltration to data exfiltration, identify common attack vectors and lateral movement, and learn to detect indicators of compromise for SOC analysts.

Master Wireshark for pcap analysis by exploring capture file properties, statistics, protocol hierarchy, conversations, and name resolution to map endpoints and traffic flows.

Explore Windows architecture from a SOC analyst perspective, distinguishing user mode and kernel mode, system calls, and the role of drivers, EDR, and LOLBins in attacks.

Understand Windows core processes such as sms.exe, lsass.exe, svchost.exe, csrss.exe, dllhost.exe, and explorer.exe, their boot sequence, roles in authentication and authorization, and how malware masquerades as them.

Learn to read Windows registries and logs to detect threats, using Sysinternals tools (AutoRun, Process Monitor, Process Explorer, Sysmon) and key event IDs to hunt persistence and brute force.

Explore Linux architecture, the file system hierarchy, and Linux users and permissions. Learn to monitor Linux logs, ensure log integrity, and apply Linux hardening for soc analysts.

Explore linux logs and auditing for SoC analysts, differentiating kernel and user logs while reviewing auth, wtmp, and btmp activity, and applying auditd and auditctl for integrity.

Learn to use common linux commands—ps, top, htop, btop, lsof, ss, netstat, find, stat, md5sum, sha256sum, and ls—to monitor processes, analyze network connections, inspect permissions, and detect indicators of compromise.

Master common Linux commands for SoC analysts, including who, last, cat, grep, tcpdump, ifconfig, dig, nslookup, and journalctl for authentication, network monitoring, and log analysis to detect intrusions.

View threats as intent-driven behaviors, analyze threads in logs, map indicators of compromise to cyber kill chain and mitre attack techniques, and apply behavior-first detection for early threat hunting.

Learn tactics, techniques, and procedures (TTPs) and the cyber kill chain to detect, map, and respond to attacks in a SOC, aligning alerts with tactics and phases.

Explore the Mitre attack framework, its enterprise matrix of adversarial tactics, techniques and common knowledge, and how SOC analysts map indicators of compromise to detection, threat hunting, and incident response.

Threat intelligence platforms centralize, enrich, and operationalize data from OSINT, feeds, and IOCs to guide smarter SOC decisions using STIX/TAXII and open source tools.

Map suspicious alerts to the mitre attack matrix to identify tactics and techniques. Build detection logic using log sources and threat intelligence platforms.

Explore what siem is, how security information and event management forms the brain of the soc, enabling correlation, normalization, enrichment, and proactive threat detection.

Explore the types of logs in a siem environment, from authentication and system to cloud and audit logs, and learn data ingestion, detection, correlation, alerting, and incident response.

Master the log life cycle in a CIM environment, including collection, parsing, normalization, enrichment, correlation, storage, and reporting to drive accurate alerts.

Explore Splunk's core components—universal forwarder, indexer, and search head—and learn to collect, parse, and analyze logs in real time with SPL.

Master sigma rules, a yaml-based language for portable detection logic across siem platforms, and learn to write, convert, and map rules to MITRE for cohesive detection.

Master Splunk's simple spl queries by learning core concepts—indexes, source types, events, and fields—and using core commands like search, stats, table, and eval to analyze logs.

Analyze logs to detect double extension files like invoice.pdf.exe, modify a sigma rule in yaml, and map detections to mitre attack, then present level one and level two SoC analysis.

Learn how alerts are generated from logs using field matching, time-based logic, and thresholds, then distinguish static and behavioral alerts, tune rules, and reduce false positives.

Learn to categorize alerts into reconnaissance, access, malware, lateral movement, data exfiltration, policy violations, and command-and-control, and prioritize them with automated playbooks using Mitre attack mapping.

Enrich alerts in a sim to add context, turning raw network data into actionable insights with threat intelligence, geoip, and asset details, speeding triage and decision making.

Link multiple low-fidelity alerts into high-confidence incidents through alert correlation in CIM platforms. Learn rule-based, temporal, statistical, entity-based, and threat intelligence approaches, plus drift and evasion challenges.

Develop practical skills for SOC level 1 tasks by reading logs, writing a sigma detection rule for suspicious activity, and enriching and correlating alerts across authentication, process, and network data.

Investigate brute force attacks by identifying indicators, validating alerts, and correlating authentication logs across ip addresses, geo locations, and users using sigma rules and sql queries.

Explore phishing attacks, their evolution, and indicators of compromise to detect spear phishing, vishing, smishing, and QR code phishing, plus IOC-based triage using VirusTotal and sandboxing.

Investigate malware by examining delivery vectors, indicators of compromise, and evasion techniques, and craft sigma rules and sql queries using EDR, Sysmon, and logs.

Investigate data exfiltration attacks and identify indicators of compromise using Splunk queries and Sigma rules. Build layered prevention with DLP, USB controls, UEBA, and endpoint and network monitoring.

Explore command and control (C2) as attackers' remote management of infected systems, outlining the C2 life cycle, beaconing, indicators of compromise, and SOC workflow to detect, isolate, and block C2.

Learn root cause analysis by defining the problem, collecting telemetry, constructing a timeline, and mapping findings to the MITRE framework; includes a Cobalt Strike case study.

Investigate a hacked Windows machine using hands-on forensics with PowerShell commands, host file and registry checks, and event logs to reveal infection, persistence, and the use of Mimikatz for credential dumping.

Uncover the soft ticket lifecycle from alert to ticket, with triage, escalation, and documentation. Learn best practices for managing SOC tickets, including structure, status, and evidence.

Master how to write clear, actionable soc investigation reports with timelines, kpis, and executive summaries, using a brute-force ssh incident to train incident response and decision making.

Learn how to escalate incidents, communicate with stakeholders from level 1 to 3, document with tickets using the five Ws, and perform post-incident reporting and legal coordination.

Simulate a tier one to tier two escalation for a DNS exfiltration, correlate DNS logs and a high-severity SIM alert, and prepare a structured ticket with five W's.

Profile threat actors by motivation, capability, and tactics using the diamond model and MITRE ATT&CK mappings; enrich alerts, enable threat hunting, and accelerate incident response with structured profiling.

Learn how to consume and operationalize threat intelligence feeds across strategic, operational, tactical, and technical levels. Enrich alerts, build Sigma rules, and design playbooks for proactive threat defense.

Explore how open-source intelligence, covering passive and active approaches, enriches security operations center alerts, speeds triage, and traces attacker infrastructure using VirusTotal, Shodan, URLhaus, whois, and GitHub.

Learn how SOC playbooks and runbooks drive SLA-driven, repeatable incident response with tiered analyst roles. The module covers threat intelligence, triage, enrichment, containment, escalation, and automation challenges.

Develop practical threat intelligence playbooks in the SOC, practicing external email, PowerShell, and internal IP analysis with TryHackMe SOC workbooks to guide incident triage and L2 escalation.

AI augmented triage accelerates SOC alert handling by automating triage and enriching alerts with threat intelligence and user behavior, while humans retain final judgment.

Explore how artificial intelligence enhances threat intelligence through data ingestion and normalization, pattern recognition, anomaly detection, and risk scoring, with use cases like phishing detection and IOC enrichment.

Perform a hands-on CTI task in a SOC, using OSINT and threat intel platforms to analyze a malware sample, map a backdoor framework and MITRE technique T1123.

Explore detection engineering as the structured process of building rules and alerts to detect threats in real time while minimizing false positives and aligning with SIEM, EDR, and threat intelligence.

Develop and tune rules for MITRE techniques like PowerShell, observe obfuscated commands, and version rules with change logs to ensure auditability, reproducibility, and effective detection.

Validate detections using simulated attacks and unit testing to reduce false positives and false negatives, tune rules, and adopt a detection validation pyramid with CI/CD integration.

Explore deception technology and honeypots to empower level two soc analysts with high fidelity alerts, detection rule validation, and insights for threat hunting and rule development.

Explore detection failure engineering by examining telemetry gaps, parsing issues, and logic gaps in SOCs. Study Cobalt Strike obfuscated PowerShell to learn base64 decoding, log enrichment, and broader rule logic.

Conduct a practical detection engineering lab to reverse engineer a missed mshta.exe detection, analyze Sysmon and Splunk logs, and write behavior-based sigma rules with versioned updates.

Apply detection engineering to build Sigma rules for nine indicators of compromise from a Tryhackme lab. Use logs, event IDs and process lineage to detect ransomware activity and improve detection.