02 SOC Analyst Practice

02 SOC Analyst Practice

Welcome to the SOC Analyst Practice Path.

This path moves you from general cybersecurity fundamentals into the daily work performed by SOC Analysts, Security Analysts, Blue Team Analysts and Incident Responders.

A SOC analyst does much more than watch alerts appear on a dashboard.

You need to determine:

• what happened
• whether the activity is malicious
• which systems and users are affected
• how the activity occurred
• what evidence supports your conclusion
• how serious the incident is
• whether escalation is required
• what containment actions should be considered
• how the investigation should be documented

Your goal is not to close alerts quickly. Your goal is to make evidence-based security decisions.

Path Objective

By completing this practice path, you should develop practical experience with:

• Security Operations Center workflows
• alert triage
• SIEM fundamentals
• Windows event logs
• Linux logs
• authentication investigation
• network traffic analysis
• phishing investigation
• endpoint investigation
• malware indicators
• threat intelligence
• Indicators of Compromise
• incident response
• escalation
• investigation documentation

Recommended SOC Practice Journey

Follow this sequence:

SOC Fundamentals
       ↓
Logs and Evidence
       ↓
SIEM Fundamentals
       ↓
Alert Triage
       ↓
Authentication Investigation
       ↓
Phishing Investigation
       ↓
Network Investigation
       ↓
Endpoint Investigation
       ↓
Threat Intelligence
       ↓
Incident Response
       ↓
SOC Challenges

Each stage builds skills required by the next.

Stage 01 — Understand the SOC

Before investigating alerts, understand the purpose of a Security Operations Center.

A SOC provides continuous security monitoring and investigation for an organization.

Typical responsibilities include:

• monitoring security events

• reviewing alerts

• investigating suspicious activity

• analyzing logs

• identifying threats

• escalating incidents

• coordinating response

• documenting investigations

Understand the SOC Workflow

A simplified workflow looks like:

Security Event
      ↓
Detection
      ↓
Alert
      ↓
Triage
      ↓
Investigation
      ↓
Classification
      ↓
Escalation
      ↓
Response
      ↓
Closure

Every stage matters.

Stage 02 — Logs and Security Evidence

Logs are one of the most important sources of evidence available to SOC analysts.

Applications, operating systems, network devices and cloud services continuously generate records describing activity.

Practice Working With

• Windows event logs

• Linux system logs

• authentication logs

• firewall logs

• DNS logs

• proxy logs

• web server logs

• endpoint security logs

• application logs

Learn to Read a Log

When examining an event, identify:

Timestamp

Source

Destination

Username

Hostname

IP Address

Event Type

Action

Result

Process

Protocol

Do not simply search for the word malicious.

Learn to understand what normal activity looks like.

Stage 03 — Windows Event Investigation

Windows systems generate extensive security telemetry.

SOC analysts should become comfortable investigating Windows events.

Practice Areas

Focus on:

• successful authentication

• failed authentication

• account creation

• group membership changes

• process execution

• service creation

• scheduled tasks

• PowerShell activity

• privilege usage

• security policy changes

Investigation Example

Imagine you observe:

User: administrator
Failed Logins: 37
Source IP: 10.20.5.44
Time Window: 3 minutes

Do not immediately conclude:

Brute-force attack.

Investigate further.

Ask:

• Is this user normally active?

• Is the source IP expected?

• Were any logins successful?

• Which system was targeted?

• Did activity continue afterward?

• Was a privileged session created?

SOC investigations require context.

Stage 04 — SIEM Fundamentals

A SIEM helps organizations collect, normalize, search, correlate and analyze security telemetry.

You should understand the general concepts regardless of which SIEM platform is used.

Learn the Workflow

Endpoints
Servers
Firewalls
Applications
Cloud
Identity
     ↓
Log Collection
     ↓
Normalization
     ↓
SIEM
     ↓
Detection Rules
     ↓
Alerts
     ↓
SOC Analyst

Practice Skills

Develop experience with:

• searching logs

• filtering events

• identifying patterns

• working with timestamps

• examining source IPs

• examining destination IPs

• investigating users

• correlating multiple events

• building timelines

Important Principle

A SIEM alert is:

A starting point for an investigation — not proof of compromise.

Stage 05 — Alert Triage

Alert triage is one of the most important SOC analyst skills.

The objective is to quickly understand what triggered an alert and determine what should happen next.

Triage Questions

For every alert, ask:

What?

What activity triggered the detection?

Who?

Which user, account or process was involved?

Where?

Which endpoint, server, application or cloud resource was affected?

When?

When did the activity begin?

Source?

Where did the activity originate?

Context?

Is this behavior expected?

Impact?

What could happen if the activity is malicious?

Alert Classification

After investigation, alerts commonly fall into categories such as:

True Positive

False Positive

Benign True Positive

Suspicious / Needs Investigation

The exact terminology may vary between organizations.

What matters is that your classification is supported by evidence.

Stage 06 — Authentication Investigation

Identity attacks are extremely common.

SOC analysts frequently investigate:

• failed logins

• successful logins

• password attacks

• unusual locations

• unusual devices

• privileged account activity

• suspicious authentication patterns

Practice Investigation Flow

Authentication Alert
        ↓
Identify User
        ↓
Identify Source
        ↓
Review Failures
        ↓
Review Successful Logins
        ↓
Check Device
        ↓
Check Related Activity
        ↓
Build Timeline
        ↓
Determine Risk

Example

You observe:

09:31 — Failed Login
09:31 — Failed Login
09:32 — Failed Login
09:33 — Successful Login
09:35 — Privileged Action

The successful login after repeated failures deserves additional investigation.

Your job is to determine whether the sequence represents legitimate activity or account compromise.

Stage 07 — Phishing Investigation

Phishing is one of the most common SOC investigation scenarios.

You should learn to analyze suspicious email safely.

Examine

• sender

• sender domain

• reply-to address

• recipient

• subject

• timestamps

• email headers

• URLs

• attachments

• domain reputation

• IP reputation

Investigation Workflow

Suspicious Email
       ↓
Inspect Sender
       ↓
Inspect Headers
       ↓
Inspect URLs
       ↓
Inspect Attachments
       ↓
Check Threat Intelligence
       ↓
Determine Scope
       ↓
Classify
       ↓
Respond

Think Beyond the Email

Do not stop after determining that an email is malicious.

Ask:

• Who received it?

• Did anyone click the link?

• Was anything downloaded?

• Were credentials entered?

• Did authentication activity follow?

• Are other users affected?

This turns email analysis into an incident investigation.

Stage 08 — Network Security Investigation

SOC analysts also investigate suspicious network activity.

Practice Understanding

• source IP

• destination IP

• ports

• protocols

• DNS

• HTTP

• HTTPS

• firewall events

• connection patterns

• packet captures

Useful Investigation Questions

Ask:

Who initiated the connection?

Where did it connect?

Which port was used?

Which protocol was used?

How frequently did communication occur?

Was the destination expected?

Was unusual data transferred?

Stage 09 — Packet Analysis

Packet captures can provide deeper visibility into network communication.

Become comfortable examining:

• IP addresses

• TCP connections

• DNS queries

• HTTP requests

• protocols

• ports

• connection sequences

Do not try to inspect every packet manually.

Learn to filter traffic based on your investigation hypothesis.

Example:

Security Alert
      ↓
Identify Source IP
      ↓
Filter Traffic
      ↓
Identify Connections
      ↓
Analyze Protocol
      ↓
Review Timeline
      ↓
Determine Behavior

Stage 10 — Endpoint Investigation

Endpoints often contain some of the strongest evidence during an investigation.

Practice investigating:

• processes

• parent-child processes

• services

• scheduled tasks

• startup activity

• command execution

• PowerShell

• network connections

• suspicious files

• security events

Process Relationships

Understanding process relationships is especially important.

For example:

User
 ↓
Application
 ↓
Child Process
 ↓
Command
 ↓
Network Connection

An unusual process relationship may warrant investigation.

Always evaluate it in context.

Stage 11 — Malware Investigation Fundamentals

At this stage, concentrate on malware triage and indicators, rather than advanced reverse engineering.

Learn about:

• suspicious files

• file hashes

• process behavior

• network indicators

• domains

• IP addresses

• persistence indicators

Indicators of Compromise

Common IOCs include:

IP Address
Domain
URL
File Hash
Filename
Registry Artifact
Process
Email Address

Remember:

An IOC is evidence that assists an investigation. Context still matters.

Stage 12 — Threat Intelligence

Threat intelligence provides context about attackers, infrastructure, malware and observed behaviors.

Learn how analysts use intelligence to investigate:

• suspicious IP addresses

• domains

• URLs

• file hashes

• malware families

• threat actors

• attack techniques

Intelligence Workflow

Indicator
    ↓
Enrichment
    ↓
Reputation
    ↓
Historical Context
    ↓
Related Indicators
    ↓
Investigation Decision

Never classify an event solely because one external source labels something malicious.

Correlate intelligence with your internal evidence.

Stage 13 — MITRE ATT&CK

Begin learning how attacker behavior can be mapped to MITRE ATT&CK.

Understand concepts such as:

• tactics

• techniques

• procedures

Examples of high-level attacker objectives include:

Initial Access
Execution
Persistence
Privilege Escalation
Credential Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact

Do not try to memorize the entire framework.

Learn to recognize attacker behavior and map it gradually.

Stage 14 — Incident Response

Eventually an investigation may become a confirmed security incident.

Understand the general incident-response lifecycle.

Preparation
    ↓
Detection & Analysis
    ↓
Containment
    ↓
Eradication
    ↓
Recovery
    ↓
Lessons Learned

SOC analysts frequently contribute heavily to detection and analysis.

Stage 15 — Build an Investigation Timeline

A professional investigation should reconstruct what happened.

Example:

08:41 — Phishing email delivered

08:47 — User opened email

08:48 — Suspicious URL accessed

08:49 — Authentication observed

08:52 — New process executed

08:55 — External connection established

09:02 — Security alert generated

A timeline allows you to understand the incident as a sequence rather than isolated alerts.

SOC Investigation Worksheet

Use this template during TryHackMe SOC exercises:

Alert Name:

Date/Time:

Affected User:

Affected Host:

Source IP:

Destination IP:

Alert Description:

Initial Hypothesis:

Evidence Reviewed:

Important Events:

Indicators:

Timeline:

MITRE ATT&CK Mapping:

Classification:

Severity:

Recommended Action:

Escalation Required:

Reason:

Lessons Learned:

Evidence-Based Investigation

Develop the habit of separating:

FACT

OBSERVATION

ASSUMPTION

CONCLUSION

For example:

Fact

Five failed authentications were recorded.

Observation

All attempts originated from the same IP address.

Assumption

The activity might represent password guessing.

Conclusion

Additional evidence is required before classifying the event.

This discipline is extremely valuable in professional SOC investigations.

SOC Analyst Practice Checklist

Before moving forward, evaluate your skills.

SOC Fundamentals

• I understand the purpose of a SOC

• I understand alerts and events

• I understand basic triage

• I understand escalation

Logs

• I can identify important log fields

• I can investigate authentication events

• I can correlate events using timestamps

• I can create a basic timeline

SIEM

• I understand SIEM architecture

• I can search security events

• I can filter relevant evidence

• I understand why detections generate alerts

Email

• I can investigate a suspicious email

• I understand email headers

• I can identify suspicious URLs

• I understand phishing investigation workflow

Network

• I understand source and destination IPs

• I understand ports and protocols

• I can interpret basic network traffic

• I understand packet-analysis fundamentals

Endpoint

• I can identify suspicious processes

• I understand parent-child process relationships

• I understand basic Windows security events

• I can identify common endpoint indicators

Incident Response

• I understand the incident-response lifecycle

• I can classify an alert based on evidence

• I can create an investigation timeline

• I understand when escalation may be required

Think Like a SOC Analyst

When you encounter a suspicious event, train yourself to think:

What triggered this?

What evidence supports it?

What happened before it?

What happened afterward?

Which user was involved?

Which host was involved?

Are other systems affected?

What is the scope?

What is the potential impact?

What should happen next?

This mindset is more valuable than memorizing individual SIEM queries.

From TryHackMe to GoHackersCloud Labs

TryHackMe gives you guided practice.

Your next progression should be:

Learn SOC Concepts
        ↓
TryHackMe Practice
        ↓
Guided Investigation
        ↓
GoHackersCloud SOC Labs
        ↓
GoHackersCloud Runbooks
        ↓
Independent Investigation
        ↓
SOC Projects

The amount of guidance should gradually decrease as your skills improve.

What’s Next?

➡️ 03 Ethical Hacking Practice

Next, we move from the defender’s perspective to understanding how authorized security assessments are performed.

You will build structured practice around:

• reconnaissance

• enumeration

• service discovery

• vulnerability assessment

• web security

• Linux security

• Windows security

• privilege escalation concepts

• evidence collection

• remediation

• professional reporting

Understanding offensive techniques also makes you a stronger defender because you begin recognizing security events as parts of an attack chain rather than isolated alerts.

This gives the TryHackMe area a clear progression of **Beginner → SOC → Ethical Hacking → Web → Active Directory → Cloud Security**, while the dedicated GoHackersCloud SOC Labs and Runbooks remain the deeper job-ready practice layer rather than being duplicated here.