SOC Analyst Level 1: Blue Team Fundamentals

• Read and interpret Windows, Linux, firewall and cloud logs with confidence
• Write detection queries and tune out false positives
• Run a structured alert triage workflow end to end
• Map observed activity to MITRE ATT&CK techniques
• Write incident notes and handover reports an employer would accept

1. 1

   Security Operations Foundations

   How a SOC is structured and where a Tier 1 analyst fits.

   • SOC tiers and escalation paths
   • Alert lifecycle
   • Shift handover discipline

   Open module
2. 2

   Logging & Telemetry

   Where the evidence comes from and how to collect it.

   • Windows event logs
   • Sysmon configuration
   • Linux auditd and syslog
   • Log forwarding

   Open module
3. 3

   Build Your SIEM Lab

   Stand up a working SIEM and pipe real telemetry into it.

   • Lab architecture
   • SIEM install and hardening
   • Agent onboarding
   • Index and parsing sanity checks

   Open module
4. 4

   Detection Engineering Basics

   Turn attacker behaviour into queries and rules.

   • Query language fundamentals
   • Writing your first detections
   • Tuning false positives
   • Detection documentation

   Open module
5. 5

   Threat Detection with MITRE ATT&CK

   Cover the techniques that actually show up in alerts.

   • Initial access and execution
   • Persistence and privilege escalation
   • Credential access
   • Coverage mapping

   Open module
6. 6

   Incident Response & Reporting

   Contain, document, and hand off.

   • Triage workflow
   • Containment decisions
   • Evidence collection
   • Writing the incident report

   Open module

PrimeSec does not hand you a pre-built machine. You get professional lab guides and build the environment yourself — that is where the skill comes from.

• Build a Windows + Linux detection lab in your hypervisor
• Deploy Sysmon with a tuned configuration
• Onboard endpoints into your SIEM
• Simulate brute-force authentication and detect it
• Detect suspicious PowerShell execution
• Investigate a phishing-to-execution alert chain
• Tune a noisy detection down to actionable volume
• Produce a full incident timeline from raw logs

• SOC lab build documentation with architecture diagram
• A detection rule pack with rationale and ATT&CK mapping
• A complete incident report for a simulated intrusion