Listen to this Post
Introduction:
The modern Security Operations Center (SOC) is the centralized nerve center where an organization’s security posture is actively defended. More than just a team monitoring a dashboard, the SOC operates as a high-fidelity fusion of People, Process, and Technology, utilizing a tiered analyst structure to filter noise from legitimate threats. This article dissects the core SOC roles—L1, L2, and L3—and translates their responsibilities into tangible, technical workflows, commands, and configurations used to detect, investigate, and eradicate cyber threats.
Learning Objectives:
- Objective 1: Understand the distinct responsibilities and escalation paths within a tiered SOC (L1, L2, L3) and the role of the SOC Manager.
- Objective 2: Identify the specific tools (SIEM, EDR, Vulnerability Scanners) used at each tier and how they integrate.
- Objective 3: Learn practical, step-by-step commands and queries used by analysts for alert triage, threat hunting, and incident response across Linux and Windows environments.
You Should Know:
- L1 Analyst: The First Line of Defense – Triage and Escalation
The L1 Analyst is responsible for the initial filter. They monitor the SIEM (Security Information and Event Management) console, verify alert authenticity, and categorize events. They must distinguish between a user fat-fingering a password and a brute-force attack.
Step‑by‑step guide: Alert Triage in a SIEM (Splunk Example)
When an alert fires, the L1 uses a query to gather context.
1. Isolate the Alert: Open the SIEM and locate the alert `Brute_Force_Detection` for source IP 10.0.0.55.
2. Gather Context (Splunk Query): Run a search to see all activity from that IP in the last 30 minutes.
index= sourcetype=WinEventLog:Security source_ip=10.0.0.55 | table _time, EventCode, Message, user, status | sort -_time
3. Check for Success: Look for `EventCode 4624` (Logon Success) immediately after `4625` (Logon Failure). If a success exists, this is a confirmed account compromise and requires immediate escalation to L2.
4. Geolocate the IP (Linux CLI): If the IP is external, use a command-line tool to validate if it matches expected traffic patterns.
curl -s http://ip-api.com/line/10.0.0.55?fields=query,country,isp
If the country is unexpected (e.g., a login attempt from a country where the company has no business), escalate.
- L2 Analyst: Incident Response – Containment and Mitigation
Once L1 escalates a confirmed compromise, L2 steps in to contain the threat. They move from monitoring to active defense, isolating hosts and collecting volatile data.
Step‑by‑step guide: Host Isolation and Evidence Capture
Assuming the endpoint `COMP-WIN-01` is compromised, the L2 Analyst acts:
1. Isolate the Host (Windows – if EDR is not available, use built-in tools): If you cannot use the EDR console to isolate, you can block the machine at the network level. On the host itself, you can block all non-essential traffic via the Windows Firewall via PowerShell (run as admin).
Block all inbound and outbound traffic except to the management/SIEM subnet New-NetFirewallRule -DisplayName "IncidentIsolation-InBlock" -Direction Inbound -Action Block New-NetFirewallRule -DisplayName "IncidentIsolation-OutBlock" -Direction Outbound -Action Block Allow traffic to SOC network (e.g., 192.168.1.0/24) for remote investigation New-NetFirewallRule -DisplayName "IncIsolation-AllowSOC" -Direction Outbound -RemoteAddress 192.168.1.0/24 -Action Allow
2. Capture Volatile Data (Linux Server Compromise): If the compromised asset is a Linux server, immediately capture memory and process lists before shutting down.
Capture running processes and network connections
date >> /mnt/evidence/ps_export.txt
ps aux >> /mnt/evidence/ps_export.txt
netstat -anp >> /mnt/evidence/netstat_export.txt
Capture memory using LiME (if pre-installed) or simply copy suspicious binaries
sudo xxd /dev/mem | head -100 > /mnt/evidence/memory_dump.raw Simplified example
Find recently modified suspicious files
find / -name ".elf" -mmin -10 -type f -exec ls -la {} \; >> /mnt/evidence/suspicious_files.txt
3. L3 Analyst: Threat Hunting – Proactive Detection
The L3 Analyst (Threat Hunter) doesn’t wait for alerts. They proactively search for Indicators of Compromise (IOCs) and TTPs using frameworks like MITRE ATT&CK. They write custom detection logic and perform deep-dive malware analysis.
Step‑by‑step guide: Hunting for Persistence Mechanisms (MITRE T1547)
A common persistence technique is using startup folders. An L3 analyst might hunt across the fleet for unsigned binaries in startup folders.
1. Query the EDR Database (Example using osquery): If the organization uses osquery, you can ask a fleet-wide question.
-- Find all binaries in startup folders launched in the last 7 days
SELECT
f.path AS Binary_Path,
f.filename,
f.size,
processes.pid,
processes.cmdline,
processes.start_time
FROM
processes
JOIN
file f ON processes.path = f.path
WHERE
f.directory LIKE '%AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup%'
AND processes.start_time > (strftime('%s', 'now') - 604800) -- Last 7 days
AND f.is_suid != '1'; -- Look for non-standard
2. Analyze a Suspicious Binary (Linux – Command-line): If a binary is found, perform static analysis without executing it.
Check file type and strings file /path/to/suspicious/binary strings /path/to/suspicious/binary | grep -i "http|command|execute|c2|server" Check for packed binaries using Detect It Easy (diec) diec /path/to/suspicious/binary Check its network connections in a sandbox environment (simulated) strace -e network binary_name 2>&1 | grep connect
4. Vulnerability Management Integration
SOC analysts work closely with VM teams. L2/L3 analysts often use scanners like Nessus to validate findings or check for lateral movement paths.
Step‑by‑step guide: Validating a Critical Vulnerability (EternalBlue – MS17-010)
If a scanner reports a host is vulnerable to MS17-010, an L3 might manually validate to prioritize patching.
1. Nmap Script Scan: Use the NSE script to check if the host is truly vulnerable (in a test environment or with extreme caution on production).
From a jump box, scan the specific host for the vulnerability nmap -p 445 --script smb-vuln-ms17-010 <target_ip>
2. Manual Check (Windows Registry): On the target machine, check the patch level.
Check if the specific KB is installed Get-HotFix -Id KB4012212 -ErrorAction SilentlyContinue If this returns nothing, the host is likely missing the patch.
5. Cloud SOC: Hardening a Misconfigured S3 Bucket
Modern SOCs must also monitor cloud environments. An L2/L3 analyst often responds to alerts about cloud misconfigurations.
Step‑by‑step guide: Remediating a Public S3 Bucket (AWS CLI)
An alert fires: “S3 Bucket `company-backups` is public.”
- Verify the Finding: List the bucket ACL to see the permissions.
aws s3api get-bucket-acl --bucket company-backups
- Block Public Access: Immediately apply a block to prevent data exfiltration.
Apply a public access block at the bucket level aws s3api put-public-access-block --bucket company-backups --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
- Audit the Bucket Policy: Review and remove any `”Effect”: “Allow”` with a
Principal: "".aws s3api get-bucket-policy --bucket company-backups --query Policy --output text | jq .
What Undercode Say:
- Key Takeaway 1: The SOC is a hierarchical data-processing engine. L1 filters noise, L2 contains fires, and L3 hunts the arsonists. Mastery of tools (Splunk, EDR) and protocols (network, host forensics) is required at each level.
- Key Takeaway 2: Automation is crucial, but context is king. While automated tools generate alerts, human analysis is irreplaceable for identifying false positives and novel attack chains that bypass signature-based detection.
- Analysis: The evolution of the SOC is moving towards “SOAR” (Security Orchestration, Automation, and Response) and “XDR” (Extended Detection and Response). However, the tiered structure remains relevant because it provides a clear career progression path and ensures that complex problems are handled by the most experienced staff. The commands and techniques shown above highlight the shift from passive monitoring to active, intelligence-driven defense. Analysts must now be hybrid engineers, fluent in cloud CLI tools, SIEM query languages, and operating system internals to effectively counter modern adversaries. The greatest asset remains the analyst’s ability to correlate disparate data points—a login, a file change, a network connection—into a coherent narrative of an attack.
Prediction:
As AI and Machine Learning become more embedded in SIEMs, the L1 role will shift from manual log review to “AI Validation,” where analysts verify machine-generated threat scores. The demand for L3 threat hunters will surge, as they will be tasked with feeding threat intelligence back into AI models to reduce false positives. The SOC of the future will be a hybrid human-AI entity, where automation handles the volume, but human intuition handles the complexity, specifically targeting zero-day exploits and sophisticated identity-based attacks that bypass traditional rules.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Oladapo Famodu – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
