Career capstone: SOC analyst
You live a SOC analyst’s week from start to finish, managing the alert queue, investigating cases, suggesting detections, handing over shifts and presenting the weekly report.
Level 301 · 15 lessons · 12 practice labs
Lessons
Days 1–2: the queue
- Day one: tools, access, playbooks
- Prioritising the queue: severity, asset, age
- The queue: twenty alerts on the morning shift
- The queue: tuning recurring noise
- Short task: write your first shift handover note
Days 3–4: cases
- Case: a company-wide phishing wave
- Case: an admin session at midnight
- Case: malware from a USB stick
- Case: an unusual data transfer
- Handing over to incident response
- Short task: write the report for the most important case
Day 5: improvement
- Proposing a new detection rule
- Updating a playbook
- Weekly metrics and trends
- Capstone: present the weekly report and set next week’s priorities
Practice labs
- Check your day-one access and playbooks: Test your access to the SIEM, case management and enrichment tools and find the right playbook for three alert types.
- Prioritise and work the morning shift’s twenty alerts: Order the queue by severity, asset and age, then close or escalate the first ten alerts with an evidenced verdict.
- Tune the recurring noise and write the handover note: Find why the rule producing a third of the queue fires falsely, propose a narrow exception, measure its effect on past data and add it to the shift handover note.
- Check whether a midnight admin session is legitimate: Compare the session’s source, the change calendar and the admin’s on-call status and write your verdict.
- Investigate whether malware from a USB stick spread: Review the device insertion record, the executed file and later network connections, and search for the same hash on other hosts.
- Prove and size an unusual data transfer case: Extract volume, destination and source from flow and proxy records, match them to file server access and state what left.
- Apply the criteria for handing a case to incident response: Compare four cases against the hand-off criteria and state with reasons which are passed on.
- Prepare the hand-off package for a company-wide phishing wave: Compile in case management a package with affected users, indicators, actions taken and open questions.
- Write the report for the most important case: Write a two-page report with summary, timeline, evidence, impact and recommendations that a non-technical manager can follow.
- Derive the weekly metrics from case data: Calculate the week’s alert count, true-positive rate and mean handling time.
- Propose a new detection rule for behaviour that was missed: Find the step in the week’s case that raised no alert, write a query that catches it and measure how often it would fire on past data.
- Update the playbook and present the weekly report: Add two missing steps from the case to the playbook, prepare a weekly report that interprets the trends and justify three priorities for next week.
About this course
You live a SOC analyst’s week from start to finish, managing the alert queue, investigating cases, suggesting detections, handing over shifts and presenting the weekly report.
What you will learn
- Days 1–2: the queue
- Days 3–4: cases
- Day 5: improvement
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.