SOC Analyst

SOC analysts are the front line of defense: they watch alerts, investigate suspicious activity and escalate real incidents. This roadmap prepares you for a tier-1/tier-2 analyst role. Networking and operating-system basics are recommended.

• Know basic networking and Windows/Linux
• Set up a lab with a free SIEM
• Plan your study time

• CyberA4U Academy — courses

A Security Operations Center watches for, investigates and responds to threats. Knowing who does what — tiers, detection engineers, incident responders — helps you work the queue effectively.

• Describe SOC tiers and handoffs
• Follow an alert from detection to closure
• Know what "escalate" means in your team

Tools & tech: SOC

• MITRE — 11 Strategies of a World-Class Cybersecurity Operations Center

Analysts rely on endpoint, authentication, network, email, proxy and cloud logs. Knowing what each source shows speeds up every investigation.

• List key log sources and what they reveal
• Know where to find each in your SIEM
• Recognize missing data

Tools & tech: SOC

• NIST SP 800-92 — Guide to Computer Security Log Management

The SIEM collects logs, runs detections and lets you search and pivot. Fast, accurate searching is an analyst's core skill.

• Search and filter events
• Pivot between users, hosts and IPs
• Build simple visualizations

Tools & tech: SOC

• Wazuh documentation
• Elastic Security documentation

Triage decides quickly whether an alert is real, how bad it is, and what happens next. Consistency matters more than speed.

• Apply a repeatable triage checklist
• Separate true positives, false positives and benign activity
• Set priority from impact and confidence

Tools & tech: SOC

• NIST SP 800-61 Rev. 3 — Incident Response Recommendations

Enrichment adds context — asset owner, user role, IP reputation, recent activity — that turns a raw alert into a decision.

• Use asset and identity context
• Check reputation and threat intelligence
• Look at what happened before and after

Tools & tech: SOC

• MISP — Open source threat intelligence platform

ATT&CK helps analysts understand what an alert means in an attack chain and what to look for next.

• Map alerts to ATT&CK techniques
• Anticipate the attacker's next steps
• Use ATT&CK in tickets

Tools & tech: SOC

• MITRE ATT&CK — Getting started

Phishing is still the most common way in. Analysts check headers, links and attachments safely and decide what to block and who else received it.

• Read email headers and SPF/DKIM/DMARC results
• Inspect links and attachments without opening them
• Scope other recipients

Tools & tech: SOC

• CISA — Phishing Guidance: Stopping the Attack Cycle at Phase One

Endpoint alerts are investigated through process trees, command lines, file and network activity from EDR or Sysmon.

• Read a process tree
• Spot suspicious parent/child relationships and command lines
• Decide on containment

Tools & tech: SOC

• Microsoft Sysinternals — Sysmon

Network alerts from IDS or NDR tools need context: which host, which destination, what protocol and whether it matches normal behavior.

• Read IDS alerts and packet details
• Check destination reputation and history
• Distinguish scans, noise and real threats

Tools & tech: SOC

• Suricata documentation
• Zeek documentation

Your ticket is what the next analyst, the incident responder and the auditor will read. Clear tickets save hours.

• Record what, when, where, evidence and actions taken
• Write conclusions others can verify
• Avoid jargon and guesses

Tools & tech: SOC

• NIST SP 800-61 Rev. 3 — Incident Response Recommendations

Clear escalation criteria tell you when an alert becomes an incident and who must be informed.

• Know your escalation thresholds
• Escalate with complete information
• Follow severity definitions

Tools & tech: SOC

• NIST SP 800-61 Rev. 3 — Incident Response Recommendations

Playbooks give step-by-step guidance for common alert types so every analyst handles them consistently.

• Follow playbooks accurately
• Suggest improvements when steps don't fit
• Write a simple playbook

Tools & tech: SOC

• CISA — Incident and Vulnerability Response Playbooks

When an alert becomes an incident, analysts support responders with scoping, evidence and containment actions.

• Understand the incident response lifecycle
• Know your role during incidents
• Preserve evidence

Tools & tech: SOC

• NIST SP 800-61 Rev. 3 — Incident Response Recommendations

Analysts may perform first containment actions — isolating a host, disabling an account — following approved procedures.

• Know which containment actions you may take
• Balance speed and evidence preservation
• Document every action

Tools & tech: SOC

• CISA — Incident and Vulnerability Response Playbooks

Good handoffs make sure open investigations continue smoothly across shifts: what's open, what's been done, and what's next.

• Summarize open cases clearly
• Highlight urgent items
• Use a consistent handoff template

Tools & tech: SOC

• MITRE — 11 Strategies of a World-Class Cybersecurity Operations Center

Useful SOC metrics — time to triage, false positive rates, escalation quality — also reveal when analysts are overloaded. Sustainable workloads prevent burnout.

• Understand common SOC metrics
• Report noisy detections
• Manage your own workload and breaks

Tools & tech: SOC

• MITRE — 11 Strategies of a World-Class Cybersecurity Operations Center

Analysts see which alerts are noisy or missing, which makes them great contributors to detection engineering.

• Read and understand detection rules
• Suggest tuning with evidence
• Write a simple Sigma rule

Tools & tech: SOC

• Sigma — Rules basics

Realistic practice datasets and blue-team challenges let you build and prove analyst skills before and during your first SOC job.

• Complete realistic investigation scenarios
• Document your work as portfolio pieces
• Identify weak areas to improve

Tools & tech: SOC

• Splunk — Boss of the SOC v3 dataset

Check that you can triage, investigate and escalate alerts across endpoint, network, email and cloud sources.

• Triage consistently with evidence
• Investigate using ATT&CK and enrichment
• Write clear tickets and escalations

• CyberA4U CTF Arena — practice challenges

You're ready for a SOC analyst role. Continue with Incident Response, Detection Engineering or Threat Intelligence, or a certification such as CompTIA CySA+.

• Keep practicing with datasets
• Choose your next roadmap
• Keep your investigation write-ups

• CyberA4U CTF Arena — practice challenges