Job role capstone: a SOC network analyst’s shift
In a realistic shift you triage the alert queue, investigate incidents with PCAP, Zeek and flow logs, escalate and write the shift handover report.
Level 501 · 13 lessons · 12 practice labs
Lessons
Starting the shift
- Taking over the shift: open incidents and notes
- Prioritising the alert queue: severity, asset, confidence
- Closing a false positive with evidence
- Short task: classify and justify the first 20 alerts
Investigation
- Pivoting from alert to PCAP and from PCAP to Zeek
- Scoping affected hosts with flow data
- The containment request: a clear, evidenced ask to the network team
- Escalation: when, to whom and with what information
- Short task: confirm or refute a high-severity alert within 30 minutes
Closing the shift
- Writing the incident ticket: time, evidence, decision
- Feedback to the detection team: noisy and missing rules
- The shift handover report
- Capstone: run a full shift and deliver the handover report
Practice labs
- Take over the shift: Read the open incidents in the handover note and order the first three tasks with reasons.
- Classify the first twenty alerts: Classify the twenty alerts in the queue by severity, asset value and confidence and justify each decision in a sentence.
- Close a false positive with evidence: Show with PCAP and Zeek evidence that an alert is a false positive and write the closing note.
- Pivot from alert to PCAP: Find the session in the PCAP archive from an alert's flow details and export it.
- Scope affected hosts with flows: Derive every internal host that connected to the suspicious destination from flow data.
- Confirm a high-severity alert in 30 minutes: Under a time limit, confirm or refute the alert from PCAP, Zeek and flow data and write your verdict with evidence.
- The escalation decision: Decide in three scenarios whether to escalate and to whom.
- A containment request to the network team: Write a clear request containing the address to block, scope, evidence and rollback condition.
- Feedback to the detection team: Report the two noisiest rules of the shift and one missing detection with sample evidence.
- Write an incident record: Fill in the record for one incident with time, evidence and decision.
- The shift handover report: Gather open, closed and to-watch incidents in a report the next analyst can read in five minutes.
- Run a full shift: Prioritise the alerts in the Selvikent Belediyesi lab SOC queue, investigate one incident to the end and hand in the handover report.
About this course
In a realistic shift you triage the alert queue, investigate incidents with PCAP, Zeek and flow logs, escalate and write the shift handover report.
What you will learn
- Starting the shift
- Investigation
- Closing the shift
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.