Guided learning path

SOC analyst foundations

Form a hypothesis, review evidence and explain a proportionate next action.

10 lessons · Approximately 63 minutes · Learn at your pace

Logs: What Happened, and What Is Still Unknown?Read an event record without confusing an observation with proof of an attack.6 minLesson
SIEM ExplainedFollow a security event from collection through normalization, correlation and analyst investigation.6 minLesson
EDR ExplainedConnect process, file and network activity on a device, then evaluate a response with context.6 minLesson
Think Like an Analyst: Triage a Sign-in AlertWork through fictional evidence, competing explanations and a justified next action.7 minLesson
IOC vs TTPCompare a specific observable with a pattern of behavior, and see why both need context.6 minLesson
MISP ExplainedFollow an indicator through structured context, enrichment, correlation and a carefully scoped detection decision.6 minLesson
MITRE ATT&CK ExplainedUnderstand tactics, techniques and evidence, then explore a versioned map of observed adversary behavior.6 minLesson
Detection Coverage Is More Than an ATT&CK LabelSeparate a mapped analytic from tested visibility and a working response.7 minLesson
Incident Response: From Report to RecoveryLearn how to contain harm, gather evidence and restore service with clear ownership.7 minLesson
How an Attack Progresses Through ATT&CKFollow a fictional incident from entry to impact, switching between adversary intent and defender visibility.6 minLesson

Bring it together

Explain one idea from this path in your own words. Revisit any lesson that still feels uncertain; completion is your choice, not a timer.