Unit 8: Security Operations Center (SOC) Fundamentals

Lesson at a glance

| Item | Detail | | --------------------- | --------------------------------------------------------------------------------------- | | Suggested length | 6 × 60 minutes | | Recommended placement | Weeks 12–13 | | Prerequisite | Units 1–7 | | Materials | Wazuh or Security Onion VM, sample log sets, ticketing template, MITRE ATT&CK Navigator |

Safety: All SOC labs use canned logs and the lab range. Real incidents stay with real responders.

Standards & credential alignment

• OffSec SOC-100 alignment.
• NIST SP 800-61r2 (Computer Security Incident Handling Guide).
• MITRE ATT&CK as common language.

Learning objectives

By the end of this unit, students can:

1. Articulate Tier 1 / Tier 2 / Tier 3 SOC roles.
2. Use a SIEM (Wazuh or Security Onion) to search, filter, and pivot on events.
3. Triage an alert: validate, classify, escalate or close, with documented rationale.
4. Map observed activity to MITRE ATT&CK tactics and techniques.
5. Write a clear, factual incident ticket.

Vocabulary

• SIEM - Security Information & Event Management; aggregates logs.
• EDR - Endpoint Detection & Response.
• SOAR - Security Orchestration, Automation & Response.
• TTPs - Tactics, Techniques, Procedures (MITRE ATT&CK).
• IOC - Indicator of Compromise (hash, IP, domain, registry key).
• MTTD / MTTR - Mean Time to Detect / Respond.
• Triage - Initial assessment to determine severity and next action.
• Playbook / runbook - Documented response procedure.

Pacing

| Day | Focus | Deliverable | | --- | ----------------------------- | ---------------------------------- | | 1 | SOC roles + SIEM intro | Wazuh dashboard tour | | 2 | Log sources + writing queries | Three saved queries | | 3 | MITRE ATT&CK mapping | Map a sample alert chain to ATT&CK | | 4 | Triage workflow | Triage 5 alerts with decisions | | 5 | Ticket writing + handoff | 3 high-quality tickets | | 6 | Tabletop SOC shift simulation | Shift report |

Day 1 - SOC structure

Tier 1 (alert triage). Tier 2 (deeper investigation). Tier 3 (threat hunting, advanced IR). SOC manager / lead. Detection engineer (writes the rules). Threat intel analyst. Compensation varies by market; teach the work, not a salary promise.

Tour the SIEM:

• Dashboards
• Discover / search
• Rules / detections
• Alerts feed
• Agent fleet

Day 2 - Queries

Common log sources to land:

• Windows Security (4624, 4625, 4720, 4732, 4688)
• Sysmon (1, 3, 7, 11, 13, 22)
• Linux auth.log, audit.log
• Web server access logs
• Firewall / proxy
• DNS

Sample queries (Wazuh / Elasticsearch DSL flavor):

data.win.system.eventID: "4625" and data.win.eventdata.targetUserName: "administrator"

data.win.eventdata.commandLine: "*powershell* -enc *"

rule.groups: "authentication_failed" and source.ip: "192.168.56.0/24"

Day 3 - MITRE ATT&CK

Open the ATT&CK Navigator. Walk through tactics: Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → Exfiltration → Impact.

Take a 5-event sample chain (login failures → success from new IP → suspicious PowerShell → scheduled task created → outbound traffic to unusual destination) and map each event to a specific technique.

Day 4 - Triage

Decision tree for a Tier 1 analyst:

Alert in.
1. Is the source legit? (alert noise / known false positive?)
   - Yes (false positive)  → tune rule, close.
   - No → continue.
2. Is the activity expected? (known maintenance window? authorized user?)
   - Yes → close with note.
   - No → continue.
3. Severity?
   - Low → ticket, monitor.
   - Medium → ticket, escalate to T2 within SLA.
   - High/Critical → page T2/T3 immediately.
4. Document rationale either way.

Students triage 5 prepared alerts, write the decision and rationale.

Day 5 - Ticket writing

Good ticket has:

Title: Concise + searchable
Severity: Low/Medium/High/Critical (with rationale)
Affected assets: hostname, IP, user
Timeline: ISO 8601 timestamps
Observations: facts only, no speculation in this section
Analysis: hypothesis with confidence level
Recommended action: what should T2 do next
Evidence: log snippets, screenshots, query links

Students rewrite a bad ticket (provided) into a good ticket.

Day 6 - Shift simulation

90-minute simulated shift:

• Alerts drip in (teacher-paced or scripted timer).
• Two-person teams: analyst + recorder.
• At end of shift, write a 1-page shift handoff report.

Debrief 30 min: what was hard, what got missed, how would the runbook change?

Teacher background (read this before the lesson)

A SOC unit dies if it becomes a dashboard tour. Learners must make a decision, write it down, and live with a handoff. That is the job: not finding the "hack," but explaining what you know, what you do not know, and what the next person should do.

Teacher says, verbatim, before Day 4: "Closing an alert as a false positive with a reason is professional work. Leaving it open because you are unsure and writing nothing is not."

Canned logs will feel fake. That is the point. Real incidents stay with real responders. If a learner wants to "pull production logs from the school," that is a three-question-test moment.

Materials checklist

• [ ] Wazuh or Security Onion reachable from every seat
• [ ] Five prepared alerts with known ground truth (for Day 4)
• [ ] One deliberately bad ticket (for Day 5 rewrite)
• [ ] Ticketing template printed or in the LMS
• [ ] ATT&CK Navigator (browser) + printed tactic list as fallback

Differentiation, IEP, and 504 supports

• Reading load: Day 2 queries can be fill-in-the-blank instead of authored from scratch.
• Processing time: Day 4 can be three alerts instead of five; quality of rationale matters more than count.
• Expressive language: Tickets may be written; verbal handoff is optional except on Day 6.
• Attention: Script the Day 6 drip so no team sits idle more than three minutes.

Common misconceptions

• "More alerts = better detection." - Alert fatigue is the #1 SOC killer. Quality over quantity.
• "The SIEM tells you the answer." - The SIEM tells you what happened. You tell the story.
• "Tier 1 is dummy work." - Tier 1 is where most careers start and where most missed incidents begin.

Assessment

Triage rationale rubric (1–4): decision stated, facts vs hypothesis separated, next action named, evidence linked.

• Day 4 triage rationales.
• Day 5 ticket rewrite + tickets from Day 6.
• Day 6 shift handoff report (one page: what is open, what is closed, what the next shift must not miss).

Career connection

Tier 1 SOC work is one of the most accessible entry points in cyber because it is a documented decision process, not a cert slogan. The ticket is the portfolio piece.

Homework

Read the provided CISA alert (instructor issues one current AA-series alert). Map at least 5 reported behaviors to ATT&CK techniques. Do not scan any live infrastructure mentioned in the alert.