Mastering the Foundations of Cyber Security – SOC Analyst Notes

Tools like SIEM and EDR were another major highlight. SIEM platforms collect and analyze logs, helping us detect incidents in real time, while EDR solutions safeguard endpoints with next-generation detection, prevention, and response capabilities. Understanding how these tools process alerts, parse logs, and correlate suspicious behavior is crucial for efficient incident handling.

Deep-diving into the OSI Layers gave me more clarity on how attackers exploit different layers — from web attacks at Layer 7 to ARP spoofing at Layer 2 or ICMP flooding at Layer 3. The document explained these layers beautifully, helping me connect protocols like HTTP/HTTPS, SSH, DNS, RDP, TCP/UDP with real-world attack scenarios.

#defensive