SOC Analyst Foundations

A security operations centre runs on a simple loop: something raises a signal, an analyst decides what it means, and someone downstream acts on that decision. This course teaches the loop with your hands on the data rather than on a dashboard. You work on `soc01`, an Ubuntu 24.04 lab machine that carries `auditd`, `fail2ban` and `nginx`, plus a generator that produces a **synthetic** event bundle: SSH authentication logs containing a brute force and one successful login, nginx access logs full of web probing, a process and network snapshot, and a small JSON telemetry file shaped like endpoint-detection output. Everything you investigate is generated inside your own lab from documentation-range addresses. No production log, no customer data and no live target is ever involved. Across ten lessons you learn what each log source can and cannot prove; how to turn an alert into a bounded hypothesis; the `grep`, `awk`, `sort`, `uniq` and `jq` patterns that make a pile of lines answer a question; how brute force, password spraying, web attacks and beaconing actually look in text; how to examine processes, persistence and connections on a suspect host; how to write an `auditd` rule and a `fail2ban` jail and then test them against events you control; what to collect, hash and preserve before you change anything; and how to write an incident report whose confidence language matches its evidence. The final project hands you a fresh incident bundle and asks for a timeline, an indicator list and a report, graded against a rubric and automated lab checks. Windows telemetry is taught from the documented event IDs (4624, 4625, 4688, 7045) using synthetic JSON samples, because the lab machine is Linux.