Home / About
About SOC Analysts
A blue team notebook, published in the open for anyone working in, or working towards, a Security Operations Centre.
What this site is
SOC Analysts collects practical, step by step material for day to day SOC work: how to triage an alert, how to write and tune a detection, how to run an investigation and how to write it up. Each post aims to leave you with something you can use on your next shift.
What you will find
- Walkthroughs that take one scenario from alert to verdict.
- Detection notes with Sigma, KQL and SPL examples.
- Cheat sheets for Windows event IDs, Sysmon, query syntax and common log sources.
- Career notes for getting into the SOC and moving up the tiers.
Levels
Every post is tagged Beginner, Intermediate or Advanced so you can pick the right starting point.
Reading tools
Use the Bionic button in the header to bold the start of each word, which some readers find easier to scan, and the moon icon to switch to dark mode. Both settings are remembered on your device.
Follow along
New posts and short daily tips go out on X at @SOC_Analysts.
Note: everything here is for education. Only test techniques on systems you own or are explicitly authorised to assess.