Learn
Foundations
What a SOC actually does
A Security Operations Center exists to answer one question, continuously: is something bad happening right now. Every organization with anything worth protecting eventually needs people watching for that, because attackers don't announce themselves. They look like normal traffic until the moment they don't.
A SOC is the team, the tools, and the process built around that watching. Analysts monitor logs and alerts coming out of the environment, investigate anything that looks off, and figure out whether it's a real problem or noise. When it's real, they contain it, gather evidence, and hand off what's needed to fix the underlying issue. That's the job, stripped down to its core.
Most SOCs organize analysts into tiers. Tier 1 triages the flood of alerts and escalates what looks genuine. Tier 2 digs into the escalations, does the actual investigation, and decides what action to take. Tier 3 handles the hardest cases, hunts for things nobody's alerted on yet, and often builds the detections Tier 1 and 2 rely on. You'll move through this progression as you gain experience, and the scenarios in this platform are built to reflect it.
Defense in depth
No single control stops every attack. A firewall can be misconfigured. An antivirus signature can miss something new. A user can be tricked into clicking the wrong thing. Defense in depth is the idea that you don't rely on any one layer to hold: you stack several, so a failure in one still leaves others standing between the attacker and what they're after.
In practice this means overlapping controls at different points: network segmentation, endpoint monitoring, identity and access controls, logging and detection, and a response process for when something gets through anyway. The SOC's job sits mostly in that last stretch, monitoring and detection, but understanding the whole stack matters. When you're investigating an alert, knowing what other layers exist tells you what an attacker had to get past to reach this point, and that shapes how seriously you take it.
Network defense as an ongoing discipline
Security isn't a project you finish. Attackers adapt, new techniques emerge, and yesterday's detections stop catching today's methods. Network defense is the continuous work of watching, adjusting, and improving: tuning detections that generate too much noise, building new ones for techniques you haven't covered, and staying current on what adversaries are actually doing.
This is why the field leans so heavily on frameworks like MITRE ATT&CK, which you'll get into next: it gives everyone a shared, current map of adversary behavior to defend against, instead of everyone independently guessing at what matters.
The analyst's role, specifically
Day to day, an analyst spends most of their time in a SIEM (Security Information and Event Management platform, Elastic Security in this program), looking at logs, chasing down alerts, and trying to answer a specific question: did something bad actually happen here, and if so, what exactly.
That's a different skill than knowing security theory. It's pattern recognition built from repetition, knowing what normal looks like well enough that abnormal stands out, and being comfortable working from incomplete information toward a confident conclusion. It's also fundamentally investigative: you're reconstructing a sequence of events from scattered evidence, the same way any investigator works a case.
This is exactly why hands-on practice matters more here than in most fields. Reading about Kerberoasting and actually hunting a Kerberoasting attempt through real Event ID 4769 telemetry are genuinely different skills. The scenarios in this platform exist to build the second one.
Where to go from here
If you're new to the field, the next stop is MITRE ATT&CK: the shared language that lets everything else in this program (and in the industry) talk about adversary behavior consistently. From there, How Our Ranges Work explains exactly what you'll be looking at once you're in a scenario, and the TTP Catalog becomes your ongoing reference as you build real experience.
Where to go from here