SOC › Module 2 › Lesson 2
Roles and Tiers
Roles and tiers literacy names L1/L2/L3, IR, and threat-hunt duties — map escalation paths on YOUR $SOC_LAB handoff notes.
Visual · t29_roles_tiers
Tier literacy. $SOC_LAB only. Original Cyberlium.
Opening
L1 triages, L2 deep-dives, L3 hunts — literacy names who does what before you escalate a lab alert wrong.
Tier 1 analysts monitor queues, perform initial triage, and document findings. Tier 2 investigates complex alerts, tunes rules, and correlates across sources. Tier 3 and threat hunt teams pursue hypotheses and advanced adversary behavior. Incident response may spin up separately for active breaches. Cyberlium practices tier vocabulary on YOUR $SOC_LAB escalation card — fictional names and sample alert IDs only. Next: Tools Overview.
1. Tier duties (named)
L1: acknowledge alert, gather basic context, false-positive check, ticket notes, escalate with evidence. L2: deeper log search, rule tuning feedback, malware sandbox requests. L3/hunt: proactive campaigns, adversary emulation awareness — literacy only on Cyberlium.
On $SOC_LAB, label which tier owns each step for one sample brute-force alert.
Command guide
Try these commands — Tier duties (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: NIST IR phases (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); Elastic detection (https://www.elastic.co/guide/en/security/current/detection-engine-overview.html); Splunk ES (https://docs.splunk.com/Documentation/ES). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Escalation hygiene
Escalate with timestamp, log excerpts, affected asset list (lab fictional), and what you ruled out. Never escalate empty tickets or hide uncertainty — 'needs L2 review' is valid.
Defenders track SLA and handoff quality — students practice structured notes on lab tickets.
3. Literacy ≠ skipping tiers
Forbidden: L1 performing destructive containment on production without playbook. Allowed: tier card — L1/L2/L3 one duty each plus escalation trigger from $SOC_LAB alert.
Ship: tier and escalation card for YOUR lab alert. Next: Tools Overview.
4. What you ship: tier and escalation card for $SOC_LAB
L1/L2/L3 duties and escalation trigger on sample alert. $SOC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Tier card. $SOC_LAB named. File t29-m02-l02-roles-tiers.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Close every lab alert as false positive without notes. Escalate with zero context.
Right
Write tier and escalation card for YOUR $SOC_LAB alert. Next: Tools Overview.
Mission: map tiers on YOUR lab alert
1) List three L1 duties. 2) Name one L2 trigger from sample alert. 3) Write escalation sentence with evidence fields. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Good handoffs include what you already checked — saves L2 time.
Knowledge Check
APPLY: L1 analyst primary duty includes:
Multiple choice
Knowledge Check
APPLY: True or False: Escalating with timestamps and log excerpts is good hygiene.
True or False
Knowledge Check
APPLY: Tier literacy on Cyberlium uses:
Multiple choice