SOC fundamentals: SIEM, alert triage and playbooks
You collect logs with Wazuh and Elastic, triage and enrich alerts, respond with playbooks and hand over shifts properly.
Level 201 · 21 lessons · 21 practice labs
Lessons
Getting to know the SOC
- What a SOC is: people, process, technology: You can explain what a security operations centre does, what its day looks like and where it fits in the organisation.
- SOC tiers and roles: You can tell apart the duties of tier 1, 2 and 3 analysts, threat hunters and the SOC manager.
- Log sources: endpoint, network, identity, cloud: You know which log source answers which question and show missing sources in a coverage table.
- Short task: list an organisation’s log sources and rank them
SIEM
- What a SIEM does: collection, normalisation, correlation: You can explain how logs in different formats are mapped to common fields and correlated into alerts.
- Wazuh architecture: manager, agents, dashboard: You can draw the roles of Wazuh’s components and how data flows from agent to dashboard.
- Installing a Wazuh agent and collecting logs: You install a Wazuh agent on a Linux server and confirm that authentication and system logs reach the manager.
- Searching logs in Elastic: Kibana and KQL: You trace a specific user, IP address or event type over time in Kibana using KQL queries.
- Detection rules and Sigma as a common language: You read a Sigma rule, understand what it catches and write a simple detection rule adapted to your environment.
- Mapping alerts to MITRE ATT&CK: By mapping alerts to ATT&CK techniques, you show which behaviours you can see and where you are blind.
- Short task: find failed SSH logins in Kibana and count them by source
Alert triage
- Alert triage: true, false and benign positives: You work through set questions to decide whether an alert is a real threat, a false alarm or expected activity.
- Enrichment: IP, domain and hash reputation: You look up an alert’s IP, domain and file hash in reputation sources and back your decision with evidence.
- Severity and prioritisation: You combine asset criticality and behaviour severity to put the alert queue in the right order.
- Cutting noise: rule tuning and exceptions: You narrow a rule that keeps raising false alarms without missing real threats, and document why.
- Short task: classify five alerts and write down why
Processes
- Playbooks: phishing, suspicious login, malware: You follow step-by-step playbooks with clear decision points for three common alert types.
- Case records and escalation: You write findings into the case so they can be repeated and decide by set criteria when and to whom to escalate.
- Shift handover: what to write and how to hand over: You write a handover note that fully passes on open cases, watched indicators and pending tasks.
- SOC metrics: time to detect and time to respond: You calculate mean time to detect and respond and the false alarm rate, and track the team’s progress.
- Capstone: triage a shift’s alert queue and hand it over: You triage a fictional alert queue in Wazuh and Kibana, escalate one case and write the handover note.
Practice labs
- Choose which log source to check for this event: For five short scenarios pick the right source among endpoint, network, identity and cloud and say why.
- Find the missing log source in the coverage table: Compare the organisation’s asset list with sources connected to the SIEM and rank the blind spots.
- Detect in the SIEM the agent that stopped sending logs: Track hourly event counts per source and find the server that went quiet and when.
- List all logins of one user in Kibana: Filter by user name and event type with KQL, narrow the time range and save the results.
- Filter and count Wazuh alerts by rule level: Group alerts of level 10 and above per agent and find the machine producing the most.
- Find the success after failed logins with KQL: Match failed and successful logons from the same source with two queries and name the compromised account.
- Map an alert to an ATT&CK technique and name the missing data: Tag three alerts with technique IDs and note which log field is missing to confirm each.
- Classify five alerts as true, false or benign: Review the evidence of each alert and record your verdict with a one-sentence reason.
- Enrich the IP and domain in an alert with reputation data: Look up the indicators in the given offline reputation list and add the result to the alert note.
- Pick the real alert out of this event set: Among twenty similar alerts find the one real attack with a different context and explain what sets it apart.
- Order the alert queue by severity and asset value: Score ten alerts by asset criticality and threat severity and justify the top three.
- Find the chain behind a harmless-looking alert: Join a low-level alert with earlier and later events on the same host and show the attack chain.
- Write a narrow exception for a noisy rule: Exclude alerts triggered by the backup server for that source and process only and show the attack test is still caught.
- Find the attack an exception is hiding: Find events in the raw logs that raise no alert because of an over-broad exception and fix the exception.
- Find the three rules that raise the most alerts: Count a week of alerts per rule and list the noise candidates.
- Follow the right playbook step for this alert: Open the suspicious login playbook, carry out the next step for the alert and write the result in the case record.
- Write a complete shift handover note: Write the status of three open cases, pending work and watch points so the next shift needs no questions.
- Calculate time to detect and respond from case records: Calculate mean time to detect and respond from a month of case data and explain the case that skews the average.
- Reach a verdict from reputation results that contradict each other: Weigh three disagreeing reputation sources, passive DNS history and internal logs for one address, then close or escalate the alert and write your reasoning.
- Count one user’s failed logins with KQL: Filter authentication records by user and outcome and show the count per hour.
- Catch in one query the success that follows attempts across many accounts: Write a query for failures against more than five accounts in ten minutes from one source followed by a success, excluding the VPN exit address.
About this course
You collect logs with Wazuh and Elastic, triage and enrich alerts, respond with playbooks and hand over shifts properly.
What you will learn
- Getting to know the SOC
- SIEM
- Alert triage
- Processes
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.