PATCH//NOTES Open the interactive version
← All lessons
Defence · Beginner · 5 min

The SOC, SIEM & logs

Where most cyber careers start.

What it is

A Security Operations Center (SOC) is the team that watches for attacks around the clock. Logs from servers, laptops, firewalls and cloud services flow into a SIEM (Security Information and Event Management) tool such as Splunk, Microsoft Sentinel or Elastic, where detection rules raise alerts. Analysts triage each alert: is it real, how bad is it, and what's affected? Most alerts are false positives, so the skill is investigating quickly and calmly.

See it: How a SOC turns logs into a response

  1. Employee laptop → SIEM: Logs: 30 failed logins, then a success. Laptops, servers and cloud services send their logs to the SIEM.
  2. SIEM → SOC analyst: Alert: possible password guessing. A detection rule matches the pattern and raises an alert.
  3. SOC analyst → SIEM: Investigates. Which account? From where? What happened after the login? Most alerts are false positives, so triage is quick.
  4. SOC analyst → Employee laptop: Contains: disables the account, isolates the laptop. If it's real, the analyst contains it first and keeps the evidence. Stopped by: Playbooks make the response fast and consistent.

Step through the animated diagram in the app.

Real case · 2013

Target

Target's security tools actually alerted on the malware that went on to steal 40 million card numbers, but the alerts weren't acted on. Detection only works if someone responds.

Source: The Register: Target failed to act on security alerts

How defenders stop it

  • Collect the right logs (authentication, process creation, DNS, EDR)
  • Tune detections to cut false positives
  • Write playbooks for common alerts
  • Use MITRE ATT&CK to find coverage gaps

Try it yourself

Investigate real scenarios on CyberDefenders

Check yourself

1. What does a SIEM mainly do?

  1. Blocks all malware
  2. Collects and correlates logs to raise alerts
  3. Encrypts the network
  4. Replaces the firewall
Show answer

Collects and correlates logs to raise alerts. It gives analysts one place to search and detect across everything.

2. Most alerts turn out to be false positives. What does that mean for an analyst?

  1. Triage fast: is it real, how bad is it, what's affected?
  2. Ignore most alerts
  3. Switch detections off
  4. Escalate every alert
Show answer

Triage fast: is it real, how bad is it, what's affected?. The skill is investigating quickly and calmly so the real incidents get attention.

3. Which logs matter most to collect for detection?

  1. Authentication, process creation, DNS and EDR
  2. Screensaver settings
  3. Desktop wallpaper changes
  4. Printer page counts
Show answer

Authentication, process creation, DNS and EDR. These show who logged in, what ran, where devices connected and what endpoint protection saw.

Answer them in the app to earn XP.

Next: Incident response →