SOC Analyst Tier 1 Specialist

Topics

• · Blue team objectives, people, process, and technology
• · Confidentiality, integrity, availability, and risk
• · Security telemetry and evidence handling
• · Ethics, scope, escalation, and analyst safety

Learning objectives

• · Explain how blue team work reduces risk to business systems and users.
• · Distinguish prevention, detection, response, and recovery responsibilities.
• · Identify common security telemetry sources and their limitations.
• · Apply ethical scope and evidence-handling principles during triage.

Practical milestone

Create a defensive asset-and-threat worksheet and map each risk to a suitable telemetry source and response owner.

Topics

• · SOC team structures, tiers, and responsibilities
• · Alert intake, enrichment, triage, and case closure
• · Severity, priority, impact, and confidence
• · Shift handoffs, runbooks, and escalation

Learning objectives

• · Describe the purpose and boundaries of Tier 1 analyst work.
• · Prioritize alerts using impact, urgency, and confidence.
• · Record evidence and decisions in a reproducible case timeline.
• · Escalate incidents with concise, relevant context and recommended next steps.

Practical milestone

Triage a set of synthetic alerts, create structured case notes, and produce a handoff for one escalated event.

Topics

• · Endpoint protection and endpoint detection concepts
• · Firewalls, secure web gateways, and network controls
• · Identity, MFA, privileged access, and audit events
• · Email security, cloud controls, and telemetry integration

Learning objectives

• · Match common security controls to the threats they help prevent or detect.
• · Identify the events generated by endpoint, network, identity, and email controls.
• · Explain the limits of prevention controls and the need for layered detection.
• · Correlate control alerts with supporting evidence from another source.

Practical milestone

Build a control-to-telemetry matrix for a sample organization and identify coverage gaps for a simulated account compromise.

Topics

• · NIST Cybersecurity Framework functions
• · Incident response lifecycle and evidence preservation
• · MITRE ATT&CK tactics as defensive behavior labels
• · Control mapping, coverage, and responsible use of frameworks

Learning objectives

• · Map a defensive activity to an appropriate framework function.
• · Explain how incident response phases guide analyst actions.
• · Use ATT&CK terminology to describe observed behavior without overclaiming attribution.
• · Identify gaps between a documented control and its measurable coverage.

Practical milestone

Map a synthetic incident timeline to response phases and relevant behavior categories, noting evidence and confidence.

Topics

• · Message anatomy, headers, and authentication results
• · Sender, reply-to, domain, and URL inspection
• · Attachment metadata and safe detonation concepts
• · User reporting, evidence capture, and containment coordination

Learning objectives

• · Extract sender, routing, authentication, and URL indicators from a sample message.
• · Distinguish suspicious signals from conclusive evidence of maliciousness.
• · Handle attachments and links without opening them on a production workstation.
• · Document and escalate a phishing report using a clear evidence summary.

Practical milestone

Analyze a sanitized phishing sample, record indicators and confidence, and prepare a containment recommendation for review.

Topics

• · Packets, frames, flows, and network five-tuples
• · DNS, TCP, TLS, and common application protocols
• · Wireshark filters and packet timeline inspection
• · Baselines, anomalies, and evidence limitations

Learning objectives

• · Interpret source, destination, ports, protocol, and timing in flow records.
• · Apply display filters to isolate a relevant conversation in a capture.
• · Recognize normal protocol behavior and identify deviations for follow-up.
• · Describe what encrypted traffic metadata can and cannot establish.

Practical milestone

Inspect a benign training capture, identify the relevant DNS and HTTPS flows, and document an evidence-based timeline.

Topics

• · Network sensor placement and visibility
• · IDS/IPS signatures, alerts, and false positives
• · Flow records, DNS logs, and proxy telemetry
• · Detection validation, tuning, and escalation

Learning objectives

• · Explain how sensor placement affects available evidence.
• · Validate an IDS alert against packet, flow, and asset context.
• · Separate a detection signal from a confirmed incident conclusion.
• · Recommend safe tuning evidence without suppressing meaningful alerts.

Practical milestone

Review a synthetic network alert with flow and asset context, then write a validation note and tuning recommendation.

Topics

• · HTTP request fields and web access logs
• · WAF detections, rule context, and false positives
• · Authentication, session, and application audit events
• · Request correlation, safe evidence handling, and escalation

Learning objectives

• · Interpret common web log fields and correlate requests over time.
• · Assess WAF events using application, user, and asset context.
• · Recognize suspicious patterns while avoiding unsupported exploit conclusions.
• · Prepare a concise escalation with request identifiers and relevant timestamps.

Practical milestone

Correlate a simulated sequence of web and identity events and produce a timeline for application-owner review.

Topics

• · Windows event channels and event record structure
• · Account logon, privilege, and policy events
• · Process, service, and endpoint telemetry
• · Time correlation, host context, and collection limits

Learning objectives

• · Locate useful event context such as timestamp, host, user, and event source.
• · Correlate authentication events with endpoint telemetry.
• · Use baseline and asset information to prioritize host alerts.
• · Document investigative observations without changing the evidence source.

Practical milestone

Analyze a sanitized Windows event set, reconstruct a user-and-host timeline, and identify the events requiring escalation.

Topics

• · Systemd journal and traditional log locations
• · SSH authentication and account events
• · Process, service, and privilege-use records
• · Time synchronization, permissions, and log integrity

Learning objectives

• · Identify relevant authentication and system events in Linux logs.
• · Correlate account activity with service and process context.
• · Recognize gaps caused by retention, permissions, or incomplete logging.
• · Collect and summarize evidence using approved read-only procedures.

Practical milestone

Review synthetic Linux authentication and service logs and create an incident timeline with confidence and evidence references.

Topics

• · Malware categories and common defensive terminology
• · Hashes, signatures, metadata, and reputation context
• · Static and behavioral analysis at a conceptual level
• · Sandbox safety, containment, and escalation criteria

Learning objectives

• · Describe common malware behaviors using precise defensive language.
• · Interpret hashes and reputation as indicators rather than proof by themselves.
• · Explain why suspicious files must be handled in an isolated approved environment.
• · Escalate potential malware findings without executing samples on production systems.

Practical milestone

Classify a set of synthetic file indicators, state evidence limitations, and prepare a safe escalation package.

Topics

• · Indicator types, normalization, and enrichment
• · Reputation sources and confidence limitations
• · Safe sandbox and passive analysis workflows
• · Tool provenance, privacy, and reporting

Learning objectives

• · Normalize domains, URLs, hashes, and IP indicators for investigation.
• · Compare enrichment results while accounting for source reliability and freshness.
• · Protect organizational data when using external analysis services.
• · Record tool, timestamp, source, and confidence for each finding.

Practical milestone

Enrich synthetic indicators using approved passive sources and produce a sourced report that distinguishes facts from hypotheses.

Topics

• · Event fields, normalization, and data onboarding
• · Search time ranges, filters, and field comparisons
• · Correlation, baselines, and alert context
• · Disposition, case updates, and escalation evidence

Learning objectives

• · Construct focused searches using time bounds and relevant normalized fields.
• · Correlate events across identity, endpoint, and network data sources.
• · Validate alert context and identify missing telemetry before disposition.
• · Record a defensible decision with evidence, confidence, and next action.

Practical milestone

Triage a synthetic SIEM alert using multiple event sources and complete a case record with a justified disposition.

Topics

• · Alert intake, impact assessment, and evidence preservation
• · Cross-source event correlation and timeline construction
• · Incident classification, confidence, and escalation
• · Case documentation, shift handoff, and lessons learned

Learning objectives

• · Triage a multi-source alert using a repeatable evidence-first workflow.
• · Correlate events and distinguish confirmed facts from hypotheses.
• · Select a defensible severity, disposition, and escalation path.
• · Deliver clear case notes and a concise analyst handoff.

Practical milestone

Investigate a synthetic multi-stage alert, submit a sourced timeline and disposition, and present an escalation handoff for reviewer assessment.