SOC Analyst Roadmap Pack

A SOC (Security Operations Centre) analyst watches alerts from security tools, decides which ones are real, and passes real incidents to the right team. At L1 (entry level) the job is mostly careful reading: logs, alerts and tickets.

ExampleAn alert says "Multiple failed logins for user priya.k". You open the sign-in logs and see 14 failures from one IP address in 3 minutes, then one success. That pattern suggests a password-guessing attempt that may have worked.

TaskWrite down three questions you would answer before escalating this alert. For example: Is the IP address one the company normally uses? Did the user sign in from somewhere new? What did the account do after the successful login?

Explain your reasoningFor each question, write one sentence on why the answer changes your decision. Interviewers care more about this reasoning than about tool names.

FeedbackGood answers check the source, the time pattern and what happened after the login. If your questions only describe the alert again, practise asking "what would prove this is harmless?"

MistakeClosing the alert because the final login succeeded. A success after many failures is the reason to look closer, not a reason to stop.

SummaryThe full pack turns this habit into a 12-week routine, with a checkpoint every week so you always know whether you are ready to move on.