Foundations

Why it matters

Every alert you triage and every case you run asks the same question: did something bad happen here, and if so, what exactly. The concepts in this unit are how a SOC organizes the work of answering it, and they are the vocabulary your colleagues will use.

Knowing how the pieces fit tells you how seriously to take what you are looking at. An alert that means an attacker got past several layers is a different problem from one the first layer already stopped.

What analysts see

On a working day these ideas show up as three things.

• A queue of alerts from many sources, most of them noise. Triage is deciding quickly which ones are real.
• Evidence scattered across systems: endpoints, the network, mail, identity. No single source tells the whole story.
• A handoff at the end of every investigation, to another tier, to the team that fixes the underlying issue, or to whoever must be told.

The Range puts you in the middle of this: the evidence is in the SIEM, and you write the conclusion.

Core concept

A Security Operations Center (SOC) watches continuously for signs that something bad is happening. Attackers look like normal activity until the moment they don't, so the work is ongoing monitoring, not a one-off check. The SOC is the people, tools and process built around that watching.

Most SOCs split the work into tiers, and the learning paths here follow them. Tier 1, Analyst Foundations, triages the flow of alerts and escalates what looks genuine. Tier 2, Incident Investigation, investigates escalations, rebuilds the intrusion behind them and decides what to contain. Tier 3, Specializations, is where an analyst specializes in one of four tracks: Detection Engineering, Threat Hunting, Forensics or Malware Analysis.

Defense in depth means no single control is trusted to hold. Segmentation, endpoint monitoring, identity and access controls, logging and detection, and a response process each cover for the others' failures. When you investigate, the layers tell you what an attacker had to get past to reach the point you are looking at.

Network defense never finishes. Attackers adapt, so detections need tuning when they are noisy, new detections are needed for behavior nobody covers yet, and the team needs a shared, current map of adversary behavior. MITRE ATT&CK is that map, and Thinking in MITRE ATT&CK covers this in depth.

The analyst's core skill is knowing what normal looks like well enough that abnormal stands out, then working from incomplete evidence to a conclusion you can defend. It is investigative work: you rebuild a sequence of events from scattered records. That skill comes from repetition on real telemetry, which is why every case on the Range is hands-on.

Annotated examples

How to investigate

1. 1.

   Read what fired.

   Note the source, the host, the account and the time before you form a view.

2. 2.

   Ask whether it is normal.

   Compare with how this host and this account usually behave. The first question in triage is whether this is real.

3. 3.

   Look across layers.

   Check what the other evidence sources recorded around the same time: endpoint, network, mail. One source rarely tells the whole story.

4. 4.

   Set the scope.

   Find the first and last related activity, and every host and account involved.

5. 5.

   Decide and record.

   Close it as benign with a reason, or escalate it with the evidence that makes it real. Either way, write down what you found and where.

Common mistakes

• Mistake: Treating a blocked event as resolved.

  InsteadAsk why the attempt happened. A control that held can still point to a compromise.

• Mistake: Judging an alert from one source.

  InsteadCheck the other layers before you decide.

• Mistake: Closing an alert without a reason.

  InsteadRecord why it is benign. The next analyst will see the same pattern.

• Mistake: Escalating without evidence.

  InsteadHand over the host, account, time and records that make it real.

• Mistake: Assuming the network is either all clean or all compromised.

  InsteadScope it: which hosts, which accounts, from when to when.

• Mistake: Learning only the tool's interface.

  InsteadLearn the telemetry underneath. It transfers between products; the interface does not.

Field references

Apply it in a Case

On your next case, before you search for the attack, spend five minutes on normal: pick one host and one account and note what their ordinary activity looks like. Then look for what does not fit.

• DragnetSkills: SIEM searchTelemetry: Network
• CuckooSkills: SIEM searchTelemetry: Windows
• GhostwriterSkills: SIEM searchTelemetry: Windows

References

• NIST Cybersecurity Framework (CSF) 2.0 · NIST
• NICE Workforce Framework for Cybersecurity · CISA NICCS