Beginner → Medium120 hours

SOC Analyst L1

Learn how modern SOC analysts monitor, investigate, triage and respond to security events — by doing the work, not by memorising definitions.

Start learning path

Network AnalysisWindows SecurityLog AnalysisSIEM OperationIOC AnalysisIncident TriageThreat IntelligenceAnalyst Reporting

What you will be able to do

Decide whether an alert is a true positive, a false positive, or needs escalation — and defend that decision with evidence.
Reconstruct what happened on a host from Windows event logs and process telemetry.
Identify suspicious network behaviour such as beaconing, DNS tunnelling and unexpected outbound traffic.
Write an incident summary another analyst can act on without asking follow-up questions.

Units

01
Cybersecurity & SOC Fundamentals
What a SOC actually does, how events become alerts, and how an L1 analyst decides what matters.
BeginnerAvailable
Why you are learning this
Every shift you work begins with a queue of alerts and a finite amount of time. This module is where you learn the judgement that decides which alert you open first — the single most-used skill in the role.
Unit contents9
Theory Lessons(4)
Events, Alerts and Incidents
Theory+60 XP
True Positives, False Positives and the Cost of Both
Theory+60 XP
Triage: Deciding What to Open First
Theory+70 XP
Module 1 Knowledge Check
Knowledge Check+80 XP
Practical Labs(5)
The Midnight Login
Investigation+150 XP
The 03:00 Sweep
Investigation+150 XP
Challenge: Three Alerts, One Shift
Challenge+300 XP
Module 01 Assessment — Part B: The Recurring Lockout
Assessment+250 XP
Module 01 Assessment — Part A: Knowledge
Assessment+200 XP
02
Networking Fundamentals
OSI and TCP/IP, ports and protocols, DNS, HTTP and TLS — framed around what an analyst needs to read traffic.
BeginnerAvailable
Why you are learning this
You cannot call traffic suspicious until you know what ordinary traffic looks like.
Unit contents10
Theory Lessons(4)
Reading a Connection Record
Theory+60 XP
DNS for Analysts
Theory+70 XP
Recognising Abnormal Traffic
Theory+80 XP
Module 02 Knowledge Check — Networking
Knowledge Check+90 XP
Practical Labs(6)
Reading the Perimeter Log
Browser Lab+150 XP
Two Hosts, One Problem
Investigation+250 XP
Suspicious PowerShell Activity
Investigation+400 XP
Module Challenge: Three Signals, One Answer
Challenge+300 XP
Black Box: Suspicious Outbound Communication
Black Box+350 XP
Job Simulation (Prototype): One Alert, Start to Handover
Boss LabJob Simulation+250 XP
03
Windows Fundamentals
Processes, services, scheduled tasks, the registry, PowerShell and Active Directory from a defender's angle.
BeginnerAvailable
Why you are learning this
Most enterprise endpoints are Windows, so most of what you investigate is Windows behaviour.
Unit contents11
Theory Lessons(6)
Processes, Parents and Children
Theory+70 XP
Users, Groups and Privilege
Theory+70 XP
Services, Scheduled Tasks and Persistence
Theory+75 XP
PowerShell for Defenders
Theory+75 XP
Sysmon: Filling the Gaps
Theory+70 XP
Module 03 Knowledge Check — Windows
Knowledge Check+100 XP
Practical Labs(5)
Password Spraying Against the Domain
Browser Lab+180 XP
Four Services, One Problem
Browser Lab+200 XP
The Account That Was Not Reported
Investigation+380 XP
Module Challenge: Four Sources, One Truth
Challenge+320 XP
Black Box: Endpoint Compromise
Black Box+400 XP
04
Windows Event Logs
Event IDs taught through meaning and correlation rather than memorisation.
BeginnerAvailable
Why you are learning this
Event IDs are the raw material of nearly every host investigation you will run.
Unit contents5
Theory Lessons(4)
Logon Types: How Someone Got In
Theory+70 XP
Failure Codes and What They Rule Out
Theory+70 XP
Building a Timeline From Events
Theory+75 XP
Module 04 Knowledge Check — Windows Event Logs
Knowledge Check+100 XP
Practical Labs(1)
Three Clocks, One Incident
Browser Lab+190 XP
05
SIEM
Ingestion, fields, searching, aggregation, correlation and detection logic using Elastic/Kibana.
BeginnerAvailable
Why you are learning this
The SIEM is where you spend your shift; query fluency is what makes you fast.
Unit contents5
Theory Lessons(4)
From Raw Logs to Fields: How a SIEM Sees Your Data
Theory+60 XP
Aggregation: Turning Thousands of Events into One Answer
Theory+60 XP
Correlation and Detection Logic: From Search to Alert
Theory+70 XP
Module 05 Knowledge Check — SIEM
Knowledge Check+100 XP
Practical Labs(1)
Three Sources, One Aggregation
Browser Lab+200 XP
06
IOC Analysis
Indicator types, confidence, enrichment and pivoting — including when an indicator means nothing.
BeginnerAvailable
Why you are learning this
Indicators are how you scope an incident beyond the single host that alerted.
Unit contents5
Theory Lessons(4)
What an Indicator Actually Is — and the Pyramid of Pain
Theory+60 XP
Confidence, Context, and When an Indicator Means Nothing
Theory+60 XP
From Indicator to Adversary: Pivoting, TTPs and the Intel Lifecycle
Theory+70 XP
Module 06 Knowledge Check — IOC Analysis & Threat Intelligence
Knowledge Check+100 XP
Practical Labs(1)
Triage the Indicator Set
Browser Lab+200 XP
07
Network Investigation
PCAP, DNS, HTTP and TLS analysis for beaconing, exfiltration and malware delivery.
BeginnerAvailable
Why you are learning this
Network evidence often survives when an attacker has cleaned the host.
Unit contents5
Theory Lessons(4)
Reading Network Evidence: Flows vs Full Packets
Theory+60 XP
DNS as Evidence: Beaconing, Tunnelling and DGA
Theory+70 XP
HTTP & TLS: Delivery, C2, and the Limits of Encryption
Theory+70 XP
Module 07 Knowledge Check — Network Investigation
Knowledge Check+100 XP
Practical Labs(1)
Behaviour Over Content: Beacon, Tunnel, Exfil
Browser Lab+200 XP
08
Detection Fundamentals
What makes a detection good — fidelity, detection logic, ATT&CK mapping, and tuning without going blind.
Job-ReadyAvailable
Why you are learning this
Detections decide what reaches your queue at all; understanding them tells you how much to trust each alert.
Unit contents5
Theory Lessons(4)
What Makes a Detection Good: Fidelity Over Cleverness
Theory+60 XP
Reading Detection Logic: Selection, Condition and ATT&CK
Theory+70 XP
Tuning, Coverage and Detection-as-Code
Theory+70 XP
Module 08 Knowledge Check — Detection Fundamentals
Knowledge Check+100 XP
Practical Labs(1)
Tune a Noisy Detection Without Going Blind
Browser Lab+200 XP
09
Incident Response
The full lifecycle: validate, triage, scope, investigate, contain, eradicate, recover, learn.
Job-ReadyAvailable
Why you are learning this
Knowing what happened is only half the job; deciding what to do is the other half.
Unit contents5
Theory Lessons(4)
The Response Lifecycle: Why Order Is a Safety Rule
Theory+60 XP
Containment: The Trade-off Between Speed and Evidence
Theory+70 XP
The Incident Record: Timeline, Handover and Lessons Learned
Theory+70 XP
Module 09 Knowledge Check — Incident Response
Knowledge Check+100 XP
Practical Labs(1)
First Moves on a Confirmed Incident
Browser Lab+200 XP
10
Integrated SOC
Tying every pillar together: the analyst's loop, correlating across sources, and triaging a full queue by impact.
Job-ReadyAvailable
Why you are learning this
Real incidents do not arrive labelled by skill — this module teaches how the pillars combine into one shift.
Unit contents6
Theory Lessons(4)
The Analyst's Loop: From Alert Queue to Decision
Theory+60 XP
Correlating Across the Pillars: One Incident, Every Source
Theory+70 XP
Prioritisation and Judgement: Triaging a Full Queue
Theory+70 XP
Module 10 Knowledge Check — Integrated SOC
Knowledge Check+100 XP
Practical Labs(2)
The Integrated Shift: One Incident, Every Pillar
Browser Lab+200 XP
Final SOC Shift: One Incident, End to End
Boss LabJob Simulation+500 XP

Recommended next

SOC Analyst L2

Step up from Tier-1 triage to Tier-2 depth: correlate across sources, hunt on a hypothesis, engineer and tune detections, and lead complex investigations. Recommended after completing SOC Analyst L1.

What you will be able to do

Units

Cybersecurity & SOC Fundamentals

Theory Lessons(4)

Events, Alerts and Incidents

True Positives, False Positives and the Cost of Both

Triage: Deciding What to Open First

Module 1 Knowledge Check

Practical Labs(5)

The Midnight Login

The 03:00 Sweep

Challenge: Three Alerts, One Shift

Module 01 Assessment — Part B: The Recurring Lockout

Module 01 Assessment — Part A: Knowledge

Networking Fundamentals

Theory Lessons(4)

Reading a Connection Record

DNS for Analysts

Recognising Abnormal Traffic

Module 02 Knowledge Check — Networking

Practical Labs(6)

Reading the Perimeter Log

Two Hosts, One Problem

Suspicious PowerShell Activity

Module Challenge: Three Signals, One Answer

Black Box: Suspicious Outbound Communication

Job Simulation (Prototype): One Alert, Start to Handover

Windows Fundamentals

Theory Lessons(6)

Processes, Parents and Children

Users, Groups and Privilege

Services, Scheduled Tasks and Persistence

PowerShell for Defenders

Sysmon: Filling the Gaps

Module 03 Knowledge Check — Windows

Practical Labs(5)

Password Spraying Against the Domain

Four Services, One Problem

The Account That Was Not Reported

Module Challenge: Four Sources, One Truth

Black Box: Endpoint Compromise

Windows Event Logs

Theory Lessons(4)

Logon Types: How Someone Got In

Failure Codes and What They Rule Out

Building a Timeline From Events

Module 04 Knowledge Check — Windows Event Logs

Practical Labs(1)

Three Clocks, One Incident

SIEM

Theory Lessons(4)

From Raw Logs to Fields: How a SIEM Sees Your Data

Aggregation: Turning Thousands of Events into One Answer

Correlation and Detection Logic: From Search to Alert

Module 05 Knowledge Check — SIEM

Practical Labs(1)

Three Sources, One Aggregation

IOC Analysis

Theory Lessons(4)

What an Indicator Actually Is — and the Pyramid of Pain

Confidence, Context, and When an Indicator Means Nothing

From Indicator to Adversary: Pivoting, TTPs and the Intel Lifecycle

Module 06 Knowledge Check — IOC Analysis & Threat Intelligence

Practical Labs(1)

Triage the Indicator Set

Network Investigation

Theory Lessons(4)

Reading Network Evidence: Flows vs Full Packets

DNS as Evidence: Beaconing, Tunnelling and DGA

HTTP & TLS: Delivery, C2, and the Limits of Encryption

Module 07 Knowledge Check — Network Investigation

Practical Labs(1)

Behaviour Over Content: Beacon, Tunnel, Exfil

Detection Fundamentals

Theory Lessons(4)

What Makes a Detection Good: Fidelity Over Cleverness

Reading Detection Logic: Selection, Condition and ATT&CK

Tuning, Coverage and Detection-as-Code

Module 08 Knowledge Check — Detection Fundamentals

Practical Labs(1)