Listen to this Post
Introduction:
In today’s threat landscape, Security Operations Center (SOC) analysts are overwhelmed by a tsunami of alerts, logs, and security telemetry. While many professionals focus on mastering individual tools, the true differentiator lies in understanding the interconnected nature of security data—where a single suspicious login, when correlated with endpoint activity, DNS requests, and threat intelligence, can reveal an active intrusion. This article explores the comprehensive skill set every SOC professional must master, from foundational log analysis to advanced threat hunting, providing actionable guidance for both newcomers and seasoned analysts looking to elevate their cybersecurity game.
Learning Objectives:
- Master the complete SOC operations workflow, from log collection to containment and recovery
- Understand how to leverage MITRE ATT&CK framework for context-driven incident investigation
- Develop practical skills in log analysis, SIEM querying, and threat intelligence integration across Windows and Linux environments
1. SOC Operations Workflow: Building Your Investigation Foundation
The SOC operations workflow represents the backbone of any security program. It begins with log collection and normalization, where raw data from diverse sources is standardized into a consistent format. This is followed by alert validation, where analysts determine whether an alert represents a true positive or false positive. Threat intelligence enrichment adds context by comparing indicators against known threat actor behaviors, while MITRE ATT&CK mapping helps analysts understand the adversary’s tactics and techniques. Finally, containment and recovery ensure the incident is properly managed and systems are restored securely.
To implement this workflow effectively, analysts need to understand how to access and analyze logs across different platforms. On Linux systems, the `/var/log/` directory contains critical logs such as `auth.log` (authentication attempts), `syslog` (system events), and `kern.log` (kernel messages). The `journalctl` command provides comprehensive access to systemd logs:
View all logs since boot journalctl -b Filter by specific service (e.g., SSH) journalctl -u ssh.service View logs with timestamps and human-readable format journalctl -xe -1 50 Follow logs in real-time journalctl -f Search for failed SSH attempts grep "Failed password" /var/log/auth.log
On Windows systems, the Event Viewer provides access to Security, Application, and System logs. Key event IDs to monitor include:
- Event ID 4624: Successful logon
- Event ID 4625: Failed logon
- Event ID 4688: Process creation
- Event ID 4732: Member added to security-enabled local group
PowerShell commands enable efficient log analysis:
Get failed logon events from the last 24 hours Get-EventLog -LogName Security -InstanceId 4625 -After (Get-Date).AddDays(-1) Export events to CSV for further analysis Get-EventLog -LogName Security -InstanceId 4624,4625 | Export-Csv -Path C:\logs\auth_events.csv Query remote computer logs Get-EventLog -ComputerName REMOTE-PC -LogName Security -InstanceId 4624
2. SOC Architecture: Understanding Your Defensive Arsenal
A modern SOC relies on multiple layers of security controls working in harmony. Firewalls control network traffic based on predefined rules, while IDS/IPS systems monitor for suspicious patterns. EDR/XDR solutions provide endpoint visibility and response capabilities. SIEM platforms aggregate and correlate logs from across the enterprise, and SOAR tools automate response workflows. Identity Providers enforce access controls, and Cloud Security solutions protect modern infrastructure.
To verify firewall configurations on Linux using `iptables` or nftables:
List all iptables rules with verbose output iptables -L -v -1 Check specific chain (e.g., INPUT) iptables -L INPUT -v -1 --line-1umbers Test connectivity through specific ports nmap -p 22,443,3389 target-host Monitor firewall logs tail -f /var/log/firewall.log
For Windows firewall management:
List firewall rules with detailed information
Get-1etFirewallRule | Where-Object {$_.Enabled -eq "True"} | Format-Table DisplayName, Direction, Action
Enable logging for Windows Defender Firewall
Set-1etFirewallProfile -Profile Domain,Public,Private -LogAllowed True -LogDropped True
View firewall log file (typically located at C:\Windows\System32\LogFiles\Firewall\pfirewall.log)
Get-Content C:\Windows\System32\LogFiles\Firewall\pfirewall.log -Tail 50
Add a rule to block specific IP
New-1etFirewallRule -Direction Inbound -Action Block -RemoteAddress 192.168.1.100
- Log Sources: The Raw Material for Security Investigation
Understanding diverse log sources is critical for building complete attack timelines. Windows Event Logs provide detailed records of system and security events, while Sysmon offers deeper visibility into process creation, network connections, and file creation. Linux Logs capture system activity, authentication attempts, and application events. Firewall Logs document network traffic, DNS logs reveal domain resolution patterns, and Proxy Logs show web browsing activity. Active Directory logs track authentication and administrative changes, while Microsoft 365 and AWS CloudTrail provide cloud activity visibility.
To effectively analyze Linux logs:
Monitor all failed authentication attempts in real-time tail -f /var/log/auth.log | grep "Failed" Analyze SSH connections grep "sshd" /var/log/auth.log | less Find successful logins from unusual locations grep "Accepted" /var/log/auth.log | grep -v "192.168" Check for privilege escalation attempts grep "sudo" /var/log/auth.log | less
For Windows Sysmon configuration and analysis:
Install Sysmon with a common configuration sysmon -accepteula -i c:\path\to\sysmon-config.xml Query Sysmon events (Event ID 1 = Process creation, 3 = Network connection, 22 = DNS query) Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -FilterXPath "[System[EventID=1]]" Export Sysmon process creation events to CSV Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -FilterXPath "[System[EventID=1]]" | Export-Csv -Path C:\logs\process_events.csv
4. Essential Security Tools: Your Investigation Arsenal
Modern SOC analysts must be proficient with SIEM Platforms (Splunk, QRadar, Sentinel) for log aggregation and correlation, EDR Solutions (CrowdStrike, SentinelOne, Defender) for endpoint visibility, Threat Intelligence Platforms for IOCs and actor tracking, Digital Forensics Tools (FTK, EnCase, Autopsy) for evidence analysis, Vulnerability Scanners (Nessus, Qualys) for risk assessment, and Network Monitoring Solutions (Wireshark, Zeek) for packet analysis.
Practical SIEM query examples (using Splunk-like syntax):
Search for failed logins followed by successful logins from same source index=windows source="WinEventLog:Security" EventCode=4625 OR EventCode=4624 | transaction User, Source_IP maxspan=5m | where EventCode=4625 AND EventCode=4624 Correlate suspicious DNS queries with process creation index=sysmon EventCode=22 OR index=windows EventCode=4688 | stats values(EventCode) by Image, QueryName Detect potential data exfiltration via DNS index=network dns_qtype=TXT OR dns_qtype=ANY | stats count by dns_query, src_ip | where count > 50
For network traffic analysis using Wireshark command-line tools:
Capture HTTP traffic to/from specific IP tshark -i eth0 -f "host 192.168.1.100 and port 80" Extract DNS queries from a pcap file tshark -r capture.pcap -Y "dns.qry.name" -T fields -e dns.qry.name Find all TLS handshakes with specific SNI tshark -r capture.pcap -Y "tls.handshake.extensions_server_name" -T fields -e tls.handshake.extensions_server_name Monitor for suspicious TLS certificates tshark -i eth0 -Y "tls.handshake.certificate" -T fields -e x509ce.subjectName -e x509ce.serialNumber
5. Incident Response: Structured Process for Effective Response
A structured incident response process is essential for minimizing damage and ensuring thorough recovery. The process follows six key phases: Preparation (building incident response plans and teams), Identification (detecting and validating incidents), Containment (preventing spread), Eradication (removing the threat), Recovery (restoring systems), and Lessons Learned (improving future responses).
During containment, analysts must act quickly while preserving evidence:
Linux - Capture running processes before isolation
ps auxf > /tmp/running_processes.txt
netstat -tulpn > /tmp/network_connections.txt
ss -tulpn > /tmp/network_sockets.txt
Linux - Check for persistence mechanisms
crontab -l > /tmp/cron_jobs.txt
ls -la /etc/systemd/system/ > /tmp/systemd_services.txt
grep -r "bash" /etc/cron /var/spool/cron/
Linux - Collect file integrity evidence
find / -type f -mtime -7 -exec md5sum {} \; > /tmp/recent_modified_files.txt
Windows - Collect volatile evidence using built-in tools
tasklist /v > C:\logs\tasklist.txt
netstat -ano > C:\logs\netstat.txt
ipconfig /all > C:\logs\ipconfig.txt
systeminfo > C:\logs\systeminfo.txt
wmic process list full > C:\logs\processes.txt
Windows - Check for scheduled tasks
schtasks /query /fo csv /v > C:\logs\scheduled_tasks.csv
For eradication and recovery, use these commands:
Linux - Kill suspicious processes by name pkill -f suspicious_process_name Linux - Remove persistence mechanism rm -f /etc/systemd/system/suspicious.service systemctl daemon-reload Windows - Terminate processes with specific PID taskkill /PID 1234 /F Windows - Disable suspicious services sc stop MaliciousService sc delete MaliciousService Windows - Remove scheduled tasks schtasks /Delete /TN "SuspiciousTask" /F
6. MITRE ATT&CK: Understanding Adversary Behavior
The MITRE ATT&CK framework provides a comprehensive knowledge base of adversary tactics and techniques. It helps analysts move beyond alert fatigue by providing context about attacker behavior. Understanding common tactics like Initial Access (phishing, remote exploits), Execution (PowerShell, scheduled tasks), Persistence (registry modifications, backdoors), Privilege Escalation (Bypass User Account Control), Defense Evasion (disabling security tools), Credential Access (password dumping), Discovery (system information gathering), Lateral Movement (remote services), Collection (data staging), Exfiltration (data transfer), and Command and Control (c2 communications) enables more effective threat hunting.
Practical mapping examples:
Linux - Detect potential T1059 (Command and Scripting Interpreter)
grep -r "bash -c" /var/log/ 2>/dev/null
grep -r "perl -e" /var/log/ 2>/dev/null
Linux - Identify T1053 (Scheduled Task/Job)
grep -r "cron" /var/log/syslog
ls -la /etc/cron.daily/ /etc/cron.hourly/ /etc/cron.weekly/
Linux - Detect T1546 (Event Triggered Execution)
grep -r "/etc/profile.d/" /var/log/auth.log
ls -la /etc/profile.d/
Windows - Detect T1059.001 (PowerShell execution)
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -FilterXPath "[System[EventID=4104]]"
Windows - Detect T1482 (Domain Trust Discovery)
Get-WinEvent -LogName "Security" -FilterXPath "[System[EventID=4662]]" | Where-Object {$_.Message -match "CN=System,CN=Configuration"}
Windows - Detect T1053.005 (Scheduled Task creation)
Get-WinEvent -LogName "Security" -FilterXPath "[System[EventID=4698]]"
7. Alert Triage: Prioritizing the Noise
Alert triage is perhaps the most critical skill for SOC analysts. Not every alert deserves the same response—analysts must prioritize based on severity (critical to informational), business impact (affecting critical assets), confidence level (indicator reliability), and potential risk (attack chain phase). Effective triage involves understanding the alert’s context: Is this a known vulnerability being scanned, or is this an active exploit? Is the asset sensitive, or is it a low-value system?
For automated triage, consider this Python script approach to enrich alerts with threat intelligence:
import requests
import json
Example: Check IP against VirusTotal
def check_ip(ip_address, api_key):
url = f"https://www.virustotal.com/api/v3/ip_addresses/{ip_address}"
headers = {"x-apikey": api_key}
response = requests.get(url, headers=headers)
if response.status_code == 200:
data = response.json()
malicious_count = data['data']['attributes']['last_analysis_stats']['malicious']
suspicious_count = data['data']['attributes']['last_analysis_stats']['suspicious']
if malicious_count > 0:
return f"HIGH: IP {ip_address} flagged as malicious ({malicious_count} detections)"
elif suspicious_count > 0:
return f"MEDIUM: IP {ip_address} suspicious ({suspicious_count} detections)"
else:
return f"LOW: IP {ip_address} appears clean"
return "ERROR: Unable to query threat intelligence"
Example: Query Shodan for additional context
def query_shodan(ip_address, api_key):
url = f"https://api.shodan.io/shodan/host/{ip_address}?key={api_key}"
response = requests.get(url)
if response.status_code == 200:
data = response.json()
ports = [str(port['port']) for port in data.get('ports', [])]
return f"Open ports: {', '.join(ports)}"
return "ERROR: Shodan query failed"
What Undercode Say:
- Context is king: The best SOC analysts don’t just look at individual alerts—they understand how telemetry from Windows Event Logs, Linux logs, firewall logs, DNS logs, and EDR feeds connects to reveal complete attack narratives.
-
Skill progression: Master log analysis first, then SIEM fundamentals, then incident response procedures, and finally MITRE ATT&CK mapping. Threat hunting and threat intelligence are advanced capabilities that build on this foundation.
-
Hands-on practice: Regularly practice log analysis with real-world datasets (like SANS DFIR challenges or CyberDefender events) using the commands and scripts detailed above.
Analysis: The modern SOC analyst’s role extends far beyond console monitoring. Organizations increasingly recognize that security operations are about intelligence gathering and analysis, not just tool operations. The shift toward automated correlation and AI-assisted analysis doesn’t diminish the analyst’s importance—it increases the need for sophisticated contextual understanding. As cyberattacks become more complex and attribution becomes more challenging, analysts who can connect disparate data points and visualize attack chains using frameworks like MITRE ATT&CK will be invaluable. The ability to script automated triage checks (as shown with the Python examples) and rapidly investigate across Windows and Linux platforms separates average analysts from exceptional ones.
Prediction:
+1: The growing adoption of XDR and SIEM solutions with integrated AI capabilities will automate 60-70% of routine alert triage by 2027, freeing SOC analysts to focus on complex investigations and proactive threat hunting.
+1: As organizations continue migrating to hybrid cloud environments, demand for analysts skilled in AWS CloudTrail, Azure Activity Logs, and Google Cloud audit logs will increase by 45% over the next 24 months.
-1: The persistent shortage of qualified SOC analysts (currently over 4 million unfilled cybersecurity positions globally) will force organizations to invest heavily in automation, potentially creating a skills gap for analysts who cannot adapt to tool-agnostic, framework-driven investigation techniques.
+1: Cybersecurity training programs emphasizing hands-on log analysis across both Windows and Linux environments (using the exact commands and procedures covered in this article) will become the gold standard for SOC analyst certification within the next 18 months.
-1: Organizations that fail to implement proper alert triage and prioritization will continue suffering from alert fatigue, with studies showing that unprioritized alerting causes up to 60% of critical alerts to be missed during high-volume attack periods.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Gmfaruk Cybersecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
