SOC › Module 2 › Lesson 1
What is a SOC?
SOC literacy names the security operations center mission — detect, analyze, respond — mapped on YOUR $SOC_LAB alert scenarios before any live shift work.
Visual · t29_what_is_soc
SOC mission literacy. $SOC_LAB only. Original Cyberlium.
Opening
A SOC watches telemetry 24/7 — literacy starts with mission and outcomes, not unauthorized access to stranger dashboards.
A Security Operations Center (SOC) centralizes people, process, and technology to monitor threats, investigate alerts, and coordinate response. Functions include threat detection, incident triage, vulnerability coordination, and reporting to leadership — always within policy and privacy rules. Cyberlium maps SOC mission vocabulary on YOUR $SOC_LAB synthetic alert queue — never triage stranger employer tickets without authorization. Next: Roles & Tiers.
1. SOC mission (named)
Detect: rules and analytics surface suspicious auth, malware, phishing, and network patterns. Analyze: analysts correlate logs and enrich IOCs. Respond: escalate, contain, and document — hand off to IR when needed.
On $SOC_LAB, write one sentence per function using a fake alert from YOUR sample queue.
Command guide
Try these commands — SOC mission (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: python3, curl. Reference sites: SOC roles (https://www.first.org/global-society/teams); NIST IR (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why SOC literacy matters for L1
L1 is the front line — volume and noise are normal. Understanding mission prevents random tool clicking and missed escalations. Employers expect ticket hygiene and accurate severity labels.
Students learn vocabulary before real PII appears in live consoles — lab alerts use fictional users and hosts.
3. Lab boundary
Forbidden: claiming SOC knowledge lets you access any security dashboard. Allowed: SOC mission card — detect/analyze/respond one-liners tied to $SOC_LAB sample alert.
Ship: SOC mission card for YOUR lab scenario. Next: Roles & Tiers.
4. What you ship: SOC mission card for $SOC_LAB
Detect, analyze, respond one-liners on sample alert. $SOC_LAB named. NO live tenant work. chmod 600.
5. What you record before the next lesson
Date. SOC mission card. $SOC_LAB named. File t29-m02-l01-what-is-soc.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Log into employer SOC without onboarding ticket. Treat lab as license for stranger SIEM.
Right
Write SOC mission card for YOUR $SOC_LAB sample alert. Next: Roles & Tiers.
Mission: define SOC mission on YOUR lab alert
1) Pick one $SOC_LAB synthetic alert. 2) Write detect/analyze/respond steps in plain language. 3) Note escalation trigger. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Mission clarity beats tool speed on shift one.
Knowledge Check
APPLY: A SOC primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Cyberlium SOC practice uses $SOC_LAB sample alerts only.
True or False
Knowledge Check
APPLY: SOC literacy on Cyberlium supports:
Multiple choice