Logs, SIEM and the SOC.
This is the lesson closest to a real entry-level job. A SOC analyst's day is spent reading logs and alerts and deciding: normal or attack? Today you'll do exactly that.
Logs: the CCTV of computers
Every system writes logs: a diary of what happened and when. A login, a failed password, a file opened, a firewall block, a website visit. Like CCTV footage, logs are boring 99.9% of the time, and priceless when something goes wrong.
2026-11-10 02:14:07 sshd[812]: Failed password for root from 185.220.101.4 port 51122
2026-11-10 02:14:09 sshd[812]: Failed password for root from 185.220.101.4 port 51126
2026-11-10 02:14:11 sshd[812]: Failed password for admin from 185.220.101.4 port 51130
2026-11-10 09:02:44 sshd[901]: Accepted password for ali from 49.205.10.20 port 60211Read it like a story: someone from IP 185.220.101.4 tried to log in as "root" and "admin" at 2 a.m., failing every 2 seconds. That's an automated brute-force attempt. At 9 a.m., "ali" logged in successfully from the office IP. Normal.
SIEM: one screen for all the logs
A big company has thousands of devices, each writing logs. Nobody can read them all. A SIEM (Security Information and Event Management) collects logs from everywhere into one place, searches them, and raises alerts when something matches a rule, like "more than 20 failed logins in 1 minute".
Well-known SIEMs: Splunk, Microsoft Sentinel, IBM QRadar, Elastic, and the free Wazuh. Job ads in Hyderabad often mention Splunk or Sentinel.
The SOC: the security control room
A Security Operations Centre is a team watching the SIEM 24×7, usually in shifts.
| Level | Role | Typical tasks |
|---|---|---|
| L1 Analyst | Entry level | Watches alerts, does first checks, closes false alarms, escalates real ones |
| L2 Analyst | 2–4 years | Investigates escalated alerts deeply, contains incidents |
| L3 / Threat hunter | Senior | Hunts for hidden attackers, improves detection rules |
| SOC Manager | Lead | Runs the team, reports to management |
Triage: the core L1 skill
Most alerts are false positives: things that look suspicious but are normal. Triage means quickly answering:
- What happened? (read the alert and logs)
- Who / what is involved? (user, device, IP)
- Is it normal for this user/device? (context)
- What's the impact if real?
- Decide: close as false positive, or escalate with clear notes.
Likely a false positive. The VPN makes her appear in Frankfurt. Check that the Frankfurt IP belongs to the company VPN, then close it with a note.
Escalate now. Many users from one IP = password spraying, and one succeeded. Rahul's account is probably compromised: escalate, and recommend resetting his password and checking his activity.
Escalate. Excel shouldn't launch PowerShell to download things. This is a classic sign of a malicious document (macro).
Most SIEM alerts turn out to be…
That's why triage skill matters: closing false alarms quickly and correctly, while never missing the real one.
Interviewers often give you a log or alert and ask "What would you do?" Answer with the 5 triage steps. Mention checking context and writing clear notes. It shows you think like an analyst.
In the log above, what was 185.220.101.4 most likely doing at 2 a.m.?
Repeated failed logins for root/admin every 2 seconds is automated guessing. A defender would block that IP and make sure root login and password login over SSH are disabled.
Your task (20 min)
On Windows: open Event Viewer (search for it) → Windows Logs → Security. Look for Event ID 4624 (successful logon) and 4625 (failed logon). Find the last time you logged in. You just read real security logs. Bonus: search "Splunk free training" and look at the free Splunk Fundamentals course, which is often recommended for SOC beginners.
Lesson 11 complete!
You know what logs are, what a SIEM does, how a SOC is organised, and how to triage an alert. Next: the full incident response process, plus the Module 3 test.
Next: Incident response step by step →