Entry-Level SOC Analyst (L1) Training

An L1 analyst sees every alert first. Most of the job isn’t solving puzzles alone; it’s triaging correctly. Is this nothing, is it worth a second look, or does it need to go up the chain right now? This course is built around that question. It is investigation-first and process-driven, organised around one loop that runs through every chapter: observe, validate, investigate, correlate, decide, document and escalate. Tools, platforms and indicators will keep changing; the discipline behind that loop is what makes an analyst effective and what moves them towards L2, threat hunting, DFIR, detection engineering or cloud security. The programme runs across six levels. The foundations explain what a SOC is, how L1, L2 and L3 split the work, what a real shift looks like, and the core vocabulary every analyst needs: events, alerts and incidents, IoCs and IoAs, TTPs, baselines, false and true positives, severity and priority. They also cover security principles, networking for analysts, and Windows and Linux, including the event IDs and commands used every day. The data and tools level covers log sources and log reading, the SIEM pipeline and starter queries, EDR process trees, and the investigation toolkit. Threats and frameworks cover malware, phishing and email header analysis, MITRE ATT&CK technique by technique, and threat intelligence. The investigation level teaches the seven-step triage method, ten complete incident scenarios from failed logins to ransomware and account takeover, five documentation templates, and the metrics a SOC runs on. The final levels introduce detection engineering and cloud telemetry, then build job readiness through eleven hands-on labs, 111 interview questions and a set of quick-reference sheets. Throughout, the course teaches habits rather than heroics: never close an alert on assumption, always confirm with a second data point, contain first when ransomware is involved, check the MFA result rather than just whether MFA exists, remember that a password reset doesn’t revoke OAuth consents, and write notes clear enough that someone else could carry on from where you stopped. Assessment is an online 20-question exam at a 70% pass mark, leading to a verifiable SKEDMIA certificate.