SOC Analyst
from Scratch
96 lessons, a learning roadmap, a working tools cheatsheet, and five incident response playbooks. Every lesson opens into a full explanation, a plain "why it matters" line, and a term-by-term breakdown of exactly what's what.
How this works
Most SOC material teaches in scattered pieces. A tool walkthrough here, a certification cram-guide there, a "day in the life" video somewhere else. The pieces rarely line up. You can pass a multiple-choice exam and still freeze the first time a real alert lands in your queue, because knowing a term and knowing what to do with it are different skills.
This curriculum is the spine. Three tiers, ninety-six lessons, one career track — networking and log fundamentals at the bottom, detection engineering and threat hunting at the top. Every lesson opens into three parts: the explanation, a plain-language "why it matters on shift" line, and a breakdown — every specific term, port, event ID, or item the lesson mentions, spelled out one by one instead of buried in a paragraph.
Beyond the curriculum: a roadmap for how to move through it over time, a cheatsheet of the commands and references you'll reach for constantly, and five playbooks for the incident types that show up again and again.
Contents
Tap a tier to expand its modules. Tap any lesson title to read it — you'll get a full explanation, a "why it matters" line, and a breakdown of every term it mentions. The curriculum is split into three tiers that map directly to how real SOCs are staffed: Tier 1 is triage and fundamentals, Tier 2 is investigation and response, Tier 3 is hunting and detection engineering. Work top to bottom — each tier assumes you've absorbed the one before it. Nothing here is gated: there's no signup, no paywall, and no "premium" track. If a lesson references a tool you don't have yet, the Stack section further down lists every one of them, and the Cheatsheet holds the exact syntax so you're never stuck guessing.
What "Learn", "Lab", and "Build" actually mean
Every lesson in the curriculum below carries one of three colored tags. They aren't difficulty levels and they aren't in a fixed order within a module — they describe the kind of work the lesson asks of you, so you know what you're walking into before you open it and can plan a study session around the mode you're in the mood for.
Learn
Pure conceptual grounding. A Learn lesson builds the mental model — what a concept is, why it exists, and how it fits into the bigger picture — before you're asked to touch a single tool. There's no software required beyond reading; the job here is absorbing vocabulary and frameworks you'll lean on in every Lab and Build lesson that follows. These are the lessons to do first in a new module, and the ones worth re-reading if a later Lab feels confusing.
- Ports, protocols & services
- Windows processes, services & the registry
- Malware families: trojans, ransomware, worms, RATs
- Severity & priority scoring
Lab
Hands-on practice inside a real tool, log source, or dataset. A Lab lesson puts you inside Wireshark, a SIEM search bar, an email header, or a sandbox report and has you apply the concept from the matching Learn lesson to something concrete. This is where recognition turns into reflex — you're not just told what a DNS tunneling pattern looks like, you're shown the actual log line and asked to spot it. Labs are the closest thing on this page to sitting at a real analyst desk.
- DNS: records, resolution, tunneling abuse
- Windows Event Logs: Security, Sysmon, PowerShell
- Reading email headers & SPF/DKIM/DMARC
- URL & attachment triage with sandboxes
Build
Produce something you keep. A Build lesson has you create an artifact — a note, a report, a rule, a script, a calculation — the kind of output you'd actually hand to a teammate or drop into a portfolio. This is deliberate: reading about an escalation note and writing one yourself are completely different skills, and hiring managers care about the second. Anything you make in a Build lesson is fair game to reference later in interviews or in the Portfolio & Job Search module.
- Subnetting & CIDR by hand
- Writing an escalation note
- Sigma rules: write once, deploy anywhere
- Writing a malware analysis report that survives peer review
Use the Show filter just below to view only one type at a time — for example, filter to Lab alone if you've got an hour and just want reps, or to Build alone if you're assembling portfolio pieces for a resume push. Most study sessions work best moving through a module in the order it's listed: Learn to load the concept, Lab to see it in real data, Build to prove you can produce something with it.
Go deeper than this page
Reading builds vocabulary; these build reflexes. Each one below is free (or has a free tier) and slots into a specific point in the roadmap — practice platforms for reps, references for when you're mid-investigation and need a definition fast, and one dataset for running real queries against real attack traffic.
Guided, hands-on rooms built for total beginners. Pairs directly with Tier 1 — do a room right after its matching lesson.
A realistic simulated SOC alert queue. Closest thing to a live Tier 1 shift you can get without a job.
Investigation challenges and CTF-style labs focused entirely on defensive work, from log analysis to forensics.
Free blue-team labs built around real, publicly documented incidents — good once Tier 2 starts covering IR.
The standing reference for every tactic and technique mentioned throughout this curriculum. Bookmark it.
Free "Boss of the SOC" datasets — real attack traffic to run SPL queries against instead of made-up sample data.
Free, in-depth whitepapers written by working practitioners — most useful once terms here stop feeling brand new.
Where to ask questions and watch working analysts reason through alerts in public — useful for calibrating your own thinking.
That last one spins up a single-node Wazuh SIEM — the fastest path to the "stand up a basic Wazuh instance" milestone in Stage 1 of the Roadmap.
Roadmap
A realistic self-paced timeline from zero to Tier 3-ready. Adjust the pace to your own hours available — the order matters more than the calendar.
- Networking fundamentals — how packets actually move, common protocols (TCP/IP, DNS, HTTP), and basic subnetting.
- Windows and Linux internals — processes, file systems, permissions, and where each OS keeps its logs.
- Core security concepts — the CIA triad, authentication vs. authorization, and the common attack types you'll see referenced everywhere else.
- Your first real reps reading a SIEM — just getting comfortable navigating logs and dashboards.
- Don't skip the OS internals lessons to rush toward "real security" content — nearly every triage decision later depends on this layer.
- Begin studying for Security+
- Stand up a basic Wazuh instance in a homelab
- Start applying for Tier 1 / SOC Analyst I roles or internships — don't wait until you feel fully "ready."
- Finish the back half of Tier 1 while you're working or interviewing, not before.
- Start Tier 2's SIEM deep-dive and network security monitoring modules in parallel.
- Real ticket volume, even at an MSSP, will teach pattern recognition faster than any lab ever could.
- Pass Security+
- Land a Tier 1 role or internship
- Publish your first homelab write-up
- EDR tools — how to pivot from a SIEM alert into endpoint-level detail.
- Threat intel basics — using indicators of compromise and threat feeds to add context to an alert.
- The incident response lifecycle — identification, containment, eradication, recovery, and the after-action report.
- Digital forensics fundamentals — what evidence to collect and how to preserve it properly.
- Cloud monitoring — reading AWS/Azure logs and understanding cloud-specific attack patterns.
- Applied malware analysis — enough static and dynamic analysis to describe what a sample actually does.
- Pass CySA+ or SC-200
- Handle a full incident from detection to closure
- Threat hunting — proactively searching for what your existing alerts are missing, instead of waiting for them to fire.
- Sigma/YARA rule writing — building your own detections instead of relying only on vendor defaults.
- Purple teaming — working alongside a red team exercise to see which detections held up and which didn't.
- Enough reverse engineering to go past a sandbox verdict and explain why a sample is malicious.
- This is the tier that shifts you from "closes tickets well" to "improves the SOC's actual detection coverage."
- Pass GCIH
- Publish real Sigma/YARA rules with write-ups
- Run your first purple team exercise
- Deeper forensics and incident response path — working toward GCFA.
- Deeper threat intel and reverse engineering path — working toward GCTI/GREM.
- Governance and SOC leadership path — moving from doing the work to shaping how the team does it.
- Use the Career track to turn everything you've built into a resume, a portfolio, and a Tier 2/3 offer.
- Promoted to Tier 2/3, or hired directly into it
- Specialty certification earned
Cheatsheet
The things you'll look up constantly until they're memorized. Keep this tab open during your first few months of triage.
Windows Event IDs Security + Sysmon
| 4624 | Successful logon |
| 4625 | Failed logon |
| 4672 | Special privileges assigned (admin logon) |
| 4688 | New process created |
| 4720 | User account created |
| 1102 | Audit log cleared — high-signal red flag |
| Sysmon 1 | Process creation (full command line) |
| Sysmon 3 | Network connection |
| Sysmon 11 | File creation |
| Sysmon 22 | DNS query |
Linux log locations paths + commands
| /var/log/auth.log | SSH & sudo activity (Debian family) |
| /var/log/secure | Same, on RHEL family |
| /var/log/syslog | General system messages |
| journalctl -u ssh | Logs for one systemd unit |
| journalctl --since today | Filter by time range |
| crontab -l | List a user's scheduled jobs |
| last | Recent login history |
Common ports the ones that show up daily
| 22 | SSH |
| 25 | SMTP (mail) |
| 53 | DNS |
| 80 / 443 | HTTP / HTTPS |
| 445 | SMB — common lateral movement path |
| 3389 | RDP |
| 3306 | MySQL |
| 5985 / 5986 | WinRM (HTTP / HTTPS) |
Splunk SPL starter commands
| | stats count by src_ip | Aggregate & group |
| | eval x=y+z | Compute a new field |
| | where count > 5 | Filter on a computed value |
| | table field1 field2 | Show only chosen fields |
| | sort -count | Sort descending |
| | rex field=_raw "(?<user>\\w+)" | Extract a field with regex |
| | lookup badips.csv ip | Enrich against a lookup table |
Wireshark filters the ones you'll use most
| http | Show only HTTP traffic |
| dns | Show only DNS traffic |
| ip.addr==10.0.4.61 | Traffic to/from one host |
| tcp.port==445 | Traffic on one port |
| tcp.flags.syn==1 && tcp.flags.ack==0 | New connection attempts |
| tls.handshake.type==1 | TLS ClientHello (grab SNI) |
MITRE ATT&CK tactics the 14, in kill-chain order
| TA0043 | Reconnaissance |
| TA0042 | Resource Development |
| TA0001 | Initial Access |
| TA0002 | Execution |
| TA0003 | Persistence |
| TA0004 | Privilege Escalation |
| TA0005 | Defense Evasion |
| TA0006 | Credential Access |
| TA0007 | Discovery |
| TA0008 | Lateral Movement |
| TA0009 / TA0010 | Collection / Exfiltration |
| TA0011 | Command & Control |
| TA0040 | Impact |
Sigma rule skeleton YAML
| title: | Human-readable rule name |
| logsource: | category / product it applies to |
| detection: | selection block + condition |
| condition: selection | Boolean logic tying fields together |
| level: | low / medium / high / critical |
YARA rule skeleton syntax
| rule NAME { | Rule declaration |
| strings: | $a = "text" / hex / regex patterns |
| condition: | any of them / all of them / $a and $b |
| } | Close the rule block |
Incident Response Playbooks
Five scenarios that show up again and again in a real SOC. Tap one to open the step-by-step. These are starting templates — adapt thresholds and tooling to your own environment.
Tools you'll actually touch on shift
Every tool below shows up inside a lesson above — configured, queried, and read under pressure, not just named on a slide.
Certifications, in the order they pay off
A certification confirms the curriculum to a resume screener — it doesn't replace it. This is roughly the order hiring tends to reward for SOC roles.
Three homelabs worth building
Reading about a SIEM and running one are different skills. These are the labs that actually differentiate a SOC resume.
Wazuh SIEM & XDR
Stand up Wazuh, feed it real endpoint and network telemetry, write custom decoders and rules, and detonate contained malware samples to prove your alerts actually fire.
Splunk at scale
Ingest tens of thousands of real DNS and auth events, build SPL searches that surface beaconing and credential abuse, and ship dashboards a Tier 2 analyst would use.
Nessus vulnerability program
Run authenticated scans across a lab network, triage findings by real exploitability instead of raw CVSS, and produce a remediation report a system owner could act on.
About this project
SOC Analyst from Scratch is a free, open curriculum that writes out every core topic a Security Operations Center analyst needs — from OSI layers to detection engineering — instead of pointing at scattered blog posts and hoping they add up.
Why it exists
You can pass a certification exam and still not know what to do when a real alert lands, because reciting a definition and making a triage decision under time pressure are different skills. This curriculum is written the way a senior analyst would actually explain something to someone new on the floor: what it is, why it matters here, and exactly what each piece of vocabulary means.
How it is made
Every lesson follows the same shape: a short read, a plain-language "why it matters" line, and a term-by-term breakdown — grounded in the tools and log sources a working SOC actually uses. Corrections and additions are welcome; this is meant to be forked, edited, and run on your own machine, not treated as gospel from a vendor.
Who it's for
Anyone studying for a Tier 1 SOC role, anyone already on the floor who wants the Tier 2/3 path mapped out, and anyone building a homelab who wants to know which lab actually proves something to a hiring manager.