SOC Analyst Handwritten Document – Essential Notes and Techniques

This document is packed with essential notes, analysis techniques, and practical tips tailored for SOC Analysts! Whether you’re new to the SOC field or looking to refine your skills, this is a must-have resource to elevate your security operations. 📊🔍

You Should Know:

1. Essential SOC Analysis Commands (Linux & Windows)

• Linux Commands for Log Analysis:

  grep "Failed password" /var/log/auth.log  Check failed SSH attempts 
  journalctl -u sshd --no-pager | grep "Failed"  Systemd-based systems 
  awk '/Invalid user/{print $NF}' /var/log/auth.log | sort | uniq -c  Count brute-force attempts 
  

• Windows Event Log Analysis (PowerShell):

  Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625}  Failed login attempts 
  Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object {$_.ID -eq 1}  Process creation events 
  

2. Network Traffic Analysis with Tshark (Wireshark CLI)

tshark -r capture.pcap -Y "http.request" -T fields -e http.host  Extract HTTP hosts 
tshark -r capture.pcap -Y "dns" -T fields -e dns.qry.name  Extract DNS queries 

1. SIEM Query Examples (Splunk & ELK Stack)
   • Splunk Query for Brute-Force Detection:

     index=security sourcetype=linux_secure "Failed password" | stats count by src 
     

   • ELK (KQL) Query for Suspicious Logins:

     event.dataset: "security" AND event.action: "login-failed" | stats count by source.ip 
     

4. Threat Hunting with YARA Rules

rule Detect_Malicious_PDF { 
meta: 
description = "Detects malicious PDF files with JavaScript" 
strings: 
$js = "/JS" 
$openaction = "/OpenAction" 
condition: 
$js and $openaction 
} 

5. Automating SOC Tasks with Python

import pandas as pd 
from datetime import datetime

logs = pd.read_csv("security_logs.csv") 
failed_logins = logs[logs["event"] == "login-failed"] 
print(failed_logins.groupby("source_ip").size().sort_values(ascending=False)) 

What Undercode Say:

A SOC analyst must master log analysis, network forensics, and automation. Key tools include Grep, Wireshark, Splunk, YARA, and Python scripting. Regular practice with real-world datasets (like malware samples or breach logs) sharpens detection skills. Always verify alerts, correlate events, and document findings.

Expected Output:

• Structured security logs
• Detected brute-force IPs
• Extracted malware signatures
• Automated alert reports

(Note: No course/IT URLs were found in the original post.)

References:

Reported By: Alexrweyemamu %F0%9D%97%A6%F0%9D%97%A2%F0%9D%97%96 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram