SOC Analysts – Hands-On Projects & Playbooks

If you’re trying to move from “I know the theory” to “I can actually work a SOC shift”, this guide is built for you. It’s a practical SOC Analyst workbook packed with lab-style exercises, real alert scenarios, and workflows you can reuse on the job.

🔹 SOC Fundamentals in Practice
- Roles (L1/L2), shift models, escalation paths
- How alerts move through the triage → investigation → containment pipeline

🔹 SIEM & Log Analysis Labs
- Building basic correlation rules
- Investigating Windows / Linux auth logs, firewall logs, proxy/DNS telemetry
- Pivoting from indicators (IP, hash, domain) into full incident timelines

🔹 Alert Triage & Incident Handling
- Step-by-step playbooks for phishing, malware, brute-force, web attacks
- False-positive reduction and enrichment with OSINT & TI feeds

🔹 Threat Hunting & Use Cases
- Hypothesis-based hunts (lateral movement, persistence, data exfil)
- Example queries you can adapt for Splunk, Elastic, Sentinel, QRadar, etc.

🔹 Reporting & Documentation
- Sample incident tickets, shift handover notes, and management-ready summaries