SOC › Module 2 › Lesson 3
Tools Overview
Tools overview literacy names SIEM, EDR, ticketing, and enrichment sources — map tool roles on YOUR $SOC_LAB workflow card without live vendor login.
Visual · t29_tools_overview
SOC tools literacy. $SOC_LAB only. Original Cyberlium.
Opening
SIEM correlates, EDR watches endpoints, tickets track work — literacy names the stack before you click stranger consoles.
Common SOC tools: SIEM (Splunk, Elastic, Sentinel) for log search and rules; EDR (CrowdStrike, Defender, SentinelOne) for endpoint telemetry; ticketing (ServiceNow, Jira) for workflow; enrichment (VT, WHOIS, internal CMDB) for context. SOAR may automate playbooks — L1 still validates outcomes. Cyberlium maps tool roles on YOUR $SOC_LAB workflow diagram — sample JSON in, ticket note out — never credentials for production vendor tenants. Next: Fundamentals Lab.
1. Tool classes (named)
SIEM: ingest, search, alert rules, dashboards. EDR: process, network, file events on endpoints. Ticketing: priority, assignee, SLA, audit trail. Enrichment: threat intel and asset context — use lab-safe fictional IOCs only.
On $SOC_LAB, draw alert flow: log source → SIEM rule → L1 queue → ticket → escalation.
Command guide
Try these commands — Tool classes (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK matrix (https://attack.mitre.org/matrices/enterprise/); Sigma rule format (https://github.com/SigmaHQ/sigma/wiki/Specification); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why tool literacy precedes certification chasing
Vendor certs help but employers hire analysts who understand workflow — what to search, when to escalate, how to document. Tool names change; triage discipline persists.
Students label tools on lab diagrams before paying for stranger-tenant practice exams.
3. Ethics: no stranger vendor consoles
Forbidden: using trial abuse or leaked creds to 'learn Splunk' on production. Allowed: tools card — four classes, one example product each, $SOC_LAB sample path.
Ship: SOC tools workflow card for YOUR lab. Next: Fundamentals Lab.
4. What you ship: SOC tools workflow card for $SOC_LAB
SIEM, EDR, ticket, enrichment roles on sample path. $SOC_LAB named. NO live vendor login. chmod 600.
5. What you record before the next lesson
Date. Tools card. $SOC_LAB named. File t29-m02-l03-tools-overview.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip ticketing because SIEM search is fun. Use leaked EDR console for practice.
Right
Write SOC tools workflow card for YOUR $SOC_LAB path. Next: Fundamentals Lab.
Mission: diagram tools on YOUR lab workflow
1) Name four tool classes. 2) Draw sample alert path on paper or text. 3) Note where L1 stops and L2 starts. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Tickets are evidence — if it is not documented, it did not happen on shift.
Knowledge Check
APPLY: SIEM primary role in SOC:
Multiple choice
Knowledge Check
APPLY: True or False: Ticketing tracks priority, assignee, and audit trail for alerts.
True or False
Knowledge Check
APPLY: Tools literacy on Cyberlium avoids:
Multiple choice