🎯 What You'll Learn
- Understand endpoint and network telemetry
- Detect common attack techniques
- Investigate alerts methodically
- Communicate findings to stakeholders
About This Workbook
This defensive track trains the SOC analyst skillset: understanding the data sources that reveal attacks, building and tuning detections, and investigating alerts through to a confident verdict.
Chapter 1 — Telemetry & Data Sources
You can only detect what you can see.
- Endpoint logs
- Network data
- Log centralisation
Chapter 2 — Detecting Attacks
Recognising adversary behaviour in the noise.
- Mapping techniques to telemetry
- Detection logic
- Tuning
Chapter 3 — Investigation
Working an alert to a verdict.
- Triage
- Pivoting
- Scoping the impact
Chapter 4 — Communication
Turning analysis into action.
- Clear write-ups
- Escalation
- Metrics
Keep going. Work through each chapter in order, then apply what you learned in the matching labs.