soc-analyst-starter - Field guide for SOC Level 1 analysts — tools, labs

项目说明

<di="center">
<img src="./assets/img/header.svg" alt="SOC Analyst Starter" width="100%"/>
</div>

---

Practical field guide for getting started as a SOC Level 1 analyst. Covers foundational knowledge, essential tools, hands-on practice platforms, and career progression.

Aimed at people new to defensi — IT professionals pi to security, students, and self-learners who want a direct path into SOC work without the noise.

---

Contents

---

How to Use This Guide

There's a lot here. Don't try to absorb it all at once.

Follow the suggested order if you're new to networking and operating systems — the fundamentals section exists for a reason. Once you have a foundation, go deeper on whatever your role or interests demand.

Theory and practice go together. Reading alone won't build skills. Use the labs.

Fork this repo and annotate it as you go. Mark what you've done, what you want to revisit, and add your own notes.

---

Learning Approach

Active o. Summarize what you read, explain it back to yourself, practice in labs. Passi doesn't build skills.

Deliberate practice. Focus on specific gaps. Don't repeat what you're already comfortable with.

Spaced repetition. For definitions and concepts that need to stick, Anki works. Use it.

Document e. Keep notes on commands, workflows, errors, and fixes. Obsidian, Joplin, or plain text all work. The format doesn't matter — the habit does.

Traps to avoid:

---

Core Knowledge

Networking

Understanding how devices communicate is the baseline for spotting anomalies.

Topics to cover: OSI and TCP/IP models, IPv4/v6 and subnetting basics, common ports and protocols (HTTP/S, DNS, DHCP, ICMP, SSH, RDP), MAC addresses, switches .

Resources:

> Capture traffic on your home network with Wireshark. Understanding what normal looks like is the first step toward spotting what isn't.

---

Operating Systems

You'll be working with Windows and Linux logs constantly. Both matter.

Linux: directory structure, core commands (ls, cd, cat, grep, find, ps, awk, sed), permissions and users, log locations (/var/log/).

Windows: directory structure, CMD/PowerShell basics (ipconfig, netstat, tasklist, Get-WinEvent), Event channels and common event IDs (4624, 4625, 4688, 4698, 4720), Registry structure, Task Manager and Resource Monitor.

Resources:

> Prioritize the command line in both systems. Most analysis workflows depend on it.

---

Security Fundamentals

Topics to cover: CIA triad, AAA model, defense in depth, Cyber Kill Chain, MITRE ATT&CK (introduction), common threat types (malware, phishing, ransomware, DDoS).

Resources:

> When you read about a real breach, map it: what failed (C/I/A)? Which Kill Chain stages were used? This makes abstract concepts concrete fast.

---

SOC Tools

SIEM

The central point where logs are collected, normalized, and correlated. Your primary workspace as a Tier 1 analyst.

Key concepts: centralized log collection, event correlation, alerting, dashboards, data sources (firewall, endpoint, proxy, DNS, auth).

Platforms to learn: Wazuh (open source), Security Onion (open source), Splunk (industry standard — free trial), Microsoft Sentinel (Azure-native).

> First question when triaging a SIEM alert: false positive or true positi before escalating.

---

Packet Analysis — Wireshark

Skills to build: capture traffic, use display filters, follow TCP/UDP/HTTP streams, export objects.

> Learn 10 display filters cold. Filter first, then in.

---

Endpoint Analysis

Key concept: what an EDR does and why it matters.

Tools: Sysmon with SwiftOnSecurity config, osquery, nati (Event , Task Manager, Resource Monitor).

> Focus on Sysmon Event IDs 1 (process creation), 3 (network connection), and 11 (file creation). These three alone provide significant co.

---

Log Analysis

Linux: grep, awk, sed, sort, uniq, cut, less.
Windows: Event filters, Get-WinEvent in PowerShell, regex.

> Invest time in grep and basic regex. It sa when working through large log files.

---

Threat Intelligence

Key tools: , AbuseIPDB, Shodan, Any.Run, Hybrid Analysis.

> Use threat intel for context, not as a . Correlate findings and look for supporting e before closing or escalating.

---

Quick Reference

Commands for quick orientation during a shift or in.

Log triage — Linux

Log triage — Windows PowerShell

Wireshark display filters — SOC essentials

osquery — endpoint hunting

IOC lookup — quick triage

Sysmon event IDs — cheatsheet

| ID | Event | Why it matters |
|----|-------|----------------|
| 1 | Process creation | Command line, hashes, parent process |
| 3 | Network connection | Process → external IP mapping |
| 7 | Image loaded | DLL side-loading detection |
| 8 | CreateRemoteThread | Process injection indicator |
| 10 | ProcessAccess | LSASS access (credential dumping) |
| 11 | File created | Dropper activity |
| 15 | File stream created | Alternate Data Streams |
| 22 | DNS query | C2 domain resolution |
| 23 | File deleted | E wiping |

---

Practice Platforms

Suggested Learning Path

This is a starting suggestion — adjust based on what you already know.

1. Foundations: TryHackMe Pre-Security and Introduction to Cybersecurity paths. Linux and Windows Fundamentals. O Bandit.
2. Security concepts: Professor Messer Security+. PicoCTF for hands-on fundamentals.
3. SOC-specific: TryHackMe SOC Level 1 path.
4. Real SOC simulation: LetsDefend (alert triage, SIEM/EDR workflows). BlueTeamLabs Online (scenario-based challenges).
5. Deepen with real cases: CyberDefenders — challenges based on real incidents.

---

Platforms

| Platform | Focus | Cost |
|----------|-------|------|
| TryHackMe | Guided paths, good for beginners through SOC L1 | Freemium |
| Hack The Box Academy | Module-based, solid defensive and fundamentals content | Freemium |
| LetsDefend | SOC simulation — triage alerts, SIEM/EDR workflows | Freemium |
| BlueTeamLabs Online | 100% defensi (memory, logs, forensics) | Free/Paid |
| CyberDefenders | Blue team / IR challenges, real-case based | Free/Paid |
| PicoCTF | Beginner-friendly, good for fundamentals | Free |
| O | Linux skills through wargames | Free |
| CTFTime | CTF competition calendar | Free |

---

Home Lab

One of the better ways to practice without limitations. Doesn't need to be expensive.

Basic setup:

> Start small. Two VMs — one attacker, one target — is enough to learn a lot. Don't try to build an enterprise network on day one.

---

Staying Current

News and ad:

Communities:

---

Career Path

Roles Beyond L1

---

Certifications

Entry level:

Next steps:

Longer term:

---

CV and Job Search

---

Interview Preparation

Technical questions to prepare for:

Situational questions:

Research the company before the interview: understand their sector, likely threat profile, and tools they use. Prepare questions — it signals genuine interest.

---

Soft Skills

Technical skills get you in the door. These keep you there:

---

Contributing

Open an issue to suggest new resources, corrections, or additional sections. To contribute directly, fork the repo, make your changes on a descripti, and open a pull request with a clear description of what changed.

See CONTRIBUTING.md for the full process.

---

License: MIT

项目信息

开发语言：未知

Star 数：15

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Field guide for SOC Level 1 analysts — tools, labs, SIEM workflows, threat intel, career path, and hands-on practice resources.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。