What actually is cybersecurity?

At its simplest:

Cybersecurity = protecting systems, networks, applications, accounts, and data from unauthorized access, damage, disruption, or theft.

Imagine a company has:

• Employee laptops
• Wi-Fi/network
• Servers
• Email
• Website
• Database
• Cloud services
• Employee accounts

An attacker might try to:

Get in → gain access → increase privileges → move around → steal data → maintain access

Your job as an analyst is largely to:

Prevent → Detect → Investigate → Respond

That's the foundation.

The CIA Triad

This is probably the first thing you should genuinely understand.

CIA = Confidentiality + Integrity + Availability

Confidentiality

Only authorized people can see the information.

Example:

A company's salary database should not be accessible to every employee.

If an attacker steals the database:

Confidentiality has been compromised.

Integrity

Information remains accurate and isn't improperly modified.

Imagine an attacker changes:

Employee salary = $1,000

to:

Employee salary = $100,000

The information was altered.

That's an integrity violation.

Availability

Systems and data are available when authorized users need them.

Imagine an attacker launches a DDoS attack and takes down the company's website.

Users can't access it.

That's an availability problem.

Remember it like this:

C = Can people see what they shouldn't?

I = Did someone change something they shouldn't?

A = Can people access what they need?

Asset → Threat → Vulnerability → Risk

This chain is extremely important.

Let's use a company laptop.

Asset

Something valuable you need to protect.

Employee laptop.

Threat

Something that could cause harm.

Attacker.

Vulnerability

A weakness the attacker could exploit.

Laptop has an unpatched vulnerability.

Exploit

The method/code used to take advantage of that weakness.

Attacker uses an exploit against the vulnerability.

Risk

The potential consequence of that happening.

Attacker gains access to company data.

So:

Asset → Threat → Vulnerability → Exploit → Risk

Don't mix these up.

Threat vs Vulnerability

This trips up beginners constantly.

Threat

Potential source of harm.

Example:

Hacker.

Vulnerability

Weakness that can be exploited.

Example:

Outdated software.

The hacker isn't the vulnerability.

The outdated software isn't the threat.

They're different pieces of the problem.

Attack Surface

Imagine a company has:

• 200 laptops
• 50 employees
• 3 servers
• Website
• VPN
• Email
• Cloud storage
• Mobile app
• Wi-Fi

All the places an attacker could potentially interact with are part of the organization's:

Attack surface

The bigger the attack surface, generally, the more opportunities an attacker has.

That's why security teams try to:

Remove unnecessary services + patch vulnerabilities + restrict access + monitor activity.

Authentication vs Authorization

Another must-know distinction.

Authentication

Who are you?

You enter:

Username + Password

The system verifies your identity.

That's authentication.

Authorization

What are you allowed to do?

You successfully log in.

But you're an employee, so perhaps you can:

View your payslip
View everyone else's salary
Delete employee accounts
Access HR's private database

That's authorization.

Easy memory trick:

Authentication = Who are you?

Authorization = What can you do?

Least Privilege

This is one of the most important security principles.

Give a user only the permissions they actually need.

Imagine you're hiring someone to answer phones.

You don't give them:

Domain Administrator

access.

That's basically handing someone the keys to the kingdom because they needed to answer the bloody phone.

Instead:

Phone employee → phone permissions

HR employee → HR permissions

IT administrator → administrative permissions

This limits damage if an account gets compromised.

Defense in Depth

Never rely on one security control.

Imagine a company has:

Firewall

↓

MFA

↓

Endpoint protection

↓

SIEM monitoring

↓

Access controls

↓

Backups

If one defense fails, another can catch or limit the attack.

That's:

Defense in Depth

Think of it as security onion layers.

An attacker has to peel through multiple defenses instead of walking through one unlocked door.

Network Fundamentals

Every device communicating over a network needs some way to identify where traffic should go.

That's where an IP address comes in.

Example:

192.168.1.25

Think of it like an apartment address.

Your device:

"I'm 192.168.1.25."

Another device:

"I'm 192.168.1.50."

They can communicate across the network.

What is a port?

An IP address identifies the machine.

A port identifies the service/application endpoint.

Imagine:

IP address = apartment building

Port = specific apartment/door

For example:

192.168.1.25:443

Means:

Device 192.168.1.25, service on port 443.

Some important ports:

22 → SSH

53 → DNS

80 → HTTP

443 → HTTPS

3389 → RDP

TCP vs UDP

You'll see these constantly.

TCP

TCP is:

Connection-oriented and reliable.

It establishes communication and makes sure data arrives properly.

Used by things such as:

• HTTPS
• SSH
• FTP

UDP

UDP is:

Connectionless and lightweight.

It doesn't provide the same delivery guarantees.

It's useful where speed matters.

Examples include:

• DNS
• Streaming
• Some gaming traffic
• VoIP

Simple mental model:

TCP = "Did you get that? I'll make sure."

UDP = "I sent it. Good luck, "

DNS

This one is very important for analysts.

You type:

google.com

Your computer needs an IP address to communicate with the server.

DNS translates:

Domain → IP

Example conceptually:

example.com

↓

93.184.216.34

DNS = Domain Name System

As an analyst, suspicious DNS requests can be extremely useful.

For example, a compromised computer repeatedly contacting a suspicious domain could be evidence of command-and-control activity.

HTTP vs HTTPS

HTTP

Web communication without TLS protection.

http://

HTTPS

HTTP protected using TLS encryption.

https://

So when you log into a website over HTTPS, the connection is encrypted in transit.

Important:

HTTPS doesn't magically mean the website itself is trustworthy.

A malicious website can use HTTPS too.

Encryption protects the connection; it doesn't certify that the person on the other end is a saint.

What is a firewall?

A firewall controls network traffic according to rules.

For example:

Allow HTTPS traffic.

Block suspicious inbound traffic.

Allow internal server communication.

Think of it as a security guard checking traffic against a rulebook.

IDS vs IPS

IDS

Intrusion Detection System

Detects suspicious activity and alerts you.

Basically:

"Oi, something looks wrong."

IPS

Intrusion Prevention System

Can actively block/prevent suspicious traffic.

Basically:

"Oi, something looks wrong. I'm stopping it."

So:

IDS → Detect

IPS → Detect + Prevent

Malware

Malware simply means:

Malicious software.

Major categories:

Virus

Malicious code that attaches to other files/programs and spreads when executed.

Worm

Can spread automatically between systems.

Trojan

Pretends to be legitimate software.

Ransomware

Encrypts/locks data and demands payment.

Spyware

Secretly collects information.

RAT

Remote Access Trojan.

Allows attackers to remotely control a compromised machine.

The Attack Lifecycle

Now connect everything.

Imagine an employee receives a malicious email.

Step 1 — Initial Access

Attacker gets into the environment.

Step 2 — Execution

Malicious code runs.

Step 3 — Persistence

Attacker makes sure they can come back.

Step 4 — Privilege Escalation

They obtain higher privileges.

Step 5 — Discovery

They investigate the environment.

"What computers exist?"

"Where's the database?"

"Who is an administrator?"

Step 6 — Lateral Movement

They move to other systems.

Step 7 — Collection

They gather valuable information.

Step 8 — Exfiltration

They send stolen information outside the organization.

Step 9 — Impact

They may encrypt files, destroy data, shut down systems, etc.

This sequence is basically the beginning of thinking like a security analyst.

Your first analyst mindset

When you see suspicious activity, start asking:

WHO?

Which user/account?

WHAT?

What happened?

WHEN?

When did it happen?

WHERE?

Which machine/IP/system?

HOW?

How did it happen?

WHY?

What was the attacker trying to accomplish?

WHAT NEXT?

Did they move further into the environment?

That's investigation.

Mini Scenario

Suppose your SIEM generates this alert:

User john.smith had 35 failed login attempts followed by one successful login from an unfamiliar IP address.

You'd ask:

1. Was the account actually compromised?
2. Where did the login originate?
3. Was the IP internal or external?
4. What time did it happen?
5. Does John normally log in from that location?
6. Were the failed attempts caused by John mistyping his password?
7. What happened after the successful login?
8. Did the account access unusual resources?
9. Did it create anything?
10. Did it attempt privilege escalation?

That's the beginning of SOC analysis.

Your fundamental chain

Asset
↓
Threat
↓
Vulnerability
↓
Attack
↓
Detection
↓
Investigation
↓
Response

And for networking:

Device → IP → Port → Protocol → Traffic → Log → Alert → Investigation

Chapter review

Before moving into SIEM + logs + actual SOC investigation, you should be able to explain these without looking them up:

• CIA Triad
• Asset
• Threat
• Vulnerability
• Risk
• Attack surface
• Authentication
• Authorization
• Least privilege
• IP address
• Port
• TCP vs UDP
• DNS
• HTTP vs HTTPS
• Firewall
• IDS vs IPS
• Malware
• Initial access
• Persistence
• Privilege escalation
• Lateral movement
• Exfiltration

What is a network?

A network is simply:

Multiple devices communicating with each other.

For example:

Your laptop
     ↓
Wi-Fi router
     ↓
Internet
     ↓
Google server

Your laptop needs to know:

• Who it's talking to
• Where that device is
• What service it's communicating with
• How the communication should happen

That's where IP addresses, MAC addresses, ports and protocols come in.

IP Addresses

An IP address identifies a network interface/device at the network layer.

Example:

192.168.1.25

This is IPv4.

IPv4 looks like:

192.168.1.25

Four numbers separated by dots.

Each number ranges from:

0 → 255

Public vs Private IP

This matters a LOT in investigations.

Private IP

Used inside local/private networks.

Common private ranges:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

Example:

192.168.1.25

Your phone might have this kind of address on Wi-Fi.

Public IP

An address reachable across the public internet.

Your home router generally has a public IP assigned by your ISP.

So you might have:

Phone
192.168.1.25
     ↓
Router
203.x.x.x
     ↓
Internet

The internal address isn't normally directly visible to websites.

MAC Address

A MAC address identifies a network interface at the local network/data-link level.

Example:

A4:7B:9C:12:34:56

Think:

IP = network address

MAC = local hardware/interface identifier

But don't fall into the beginner trap of thinking a MAC address is permanently tied to a person/device in every situation. Modern devices can use randomized MAC addresses, especially for Wi-Fi privacy.

IP vs MAC

Imagine a hotel.

IP address

"Room 302"

MAC address

"The specific device/interface associated with that local network connection."

Different purposes.

Ports

This is extremely important.

Suppose a server has:

192.168.1.10

That identifies the machine.

But the machine may be running:

• Web server
• SSH
• Database
• Email service

How does traffic know which service it wants?

Ports.

For example:

192.168.1.10:443

means:

Connect to port 443 on that machine.

Important Ports

Memorize these first:

Security analyst example

Suppose you see:

192.168.1.50 → 192.168.1.10:3389

You immediately know:

Someone is communicating with the server over RDP.

Then you investigate who, when, why, and whether it's normal.

TCP

TCP = Transmission Control Protocol

TCP establishes a connection before transferring data.

The famous process is the:

Three-Way Handshake

Client                  Server
  |                       |
  | ---- SYN ----------> |
  | <--- SYN-ACK ------- |
  | ---- ACK ----------> |
  |                       |
  |   Connection ready   |

SYN

"Can we communicate?"

SYN-ACK

"Yes, I hear you."

ACK

"Cool."

Now communication begins.

Why does TCP matter to analysts?

Because network traffic can reveal suspicious behavior.

For example:

Computer
   ↓
SYN
   ↓
Server
   ↓
No response

Repeated connection attempts across thousands of ports could indicate scanning.

An attacker might essentially be asking:

"Is anything listening here?"

Again.

Again.

Again.

And again.

UDP

UDP = User Datagram Protocol

UDP doesn't establish a TCP-style connection.

It's lightweight and fast.

Conceptually:

Send → Done

No three-way handshake.

This makes it useful for things where speed matters more than guaranteed delivery.

Examples:

• DNS
• Streaming
• Gaming
• Voice/video traffic

TCP vs UDP

Memorize this:

Think:

TCP: "I need to know you received it."

UDP: "Here's the packet. I'm leaving."

DNS

You type:

youtube.com

Your computer needs an IP address.

DNS helps translate:

youtube.com
       ↓
IP address

DNS = Domain Name System

It's basically the internet's phonebook.

Why DNS matters to cybersecurity

Because attackers use domains.

Imagine an infected computer repeatedly makes DNS requests:

random-domain.com
random-domain.com
random-domain.com
random-domain.com

Then communicates with that domain.

That could be suspicious.

Analysts may investigate:

• Domain age
• Domain reputation
• DNS history
• IP address
• Frequency of requests
• What happened after the DNS lookup

DNS is therefore a valuable source of security telemetry.

HTTP

HTTP is a protocol used for web communication.

Example:

Browser → Web Server

Your browser might request:

GET /login

The server responds.

HTTP itself doesn't provide encryption.

HTTPS

HTTPS is HTTP protected using TLS.

Browser
   ↓
Encrypted HTTPS
   ↓
Web Server

This prevents someone sitting on the network from simply reading the contents of the communication in transit.

But remember:

HTTPS ≠ safe website.

A phishing website can absolutely use HTTPS.

The connection can be encrypted while the website is still malicious.

What is a packet?

Data travelling across a network gets broken into pieces called packets.

Conceptually:

Message
   ↓
[Packet 1]
[Packet 2]
[Packet 3]
[Packet 4]

Each packet contains information that helps deliver it.

You can think of it like a postal package.

It has:

• Source
• Destination
• Protocol information
• Data

The actual useful data is called the:

Payload

Source vs Destination

This terminology will appear constantly in SIEM/network logs.

Example:

Source IP:      192.168.1.25
Destination IP: 8.8.8.8
Destination Port: 53
Protocol: UDP

Translation:

Device 192.168.1.25 sent UDP traffic to 8.8.8.8 on port 53.

Port 53?

DNS.

Now you're thinking like an analyst.

Inbound vs Outbound

Inbound

Traffic coming into your system/network.

Internet
   ↓
Company Server

Outbound

Traffic leaving your system/network.

Company Computer
   ↓
Internet

Security analysts care about both.

For example:

Suspicious inbound

Internet → internal server

Could indicate:

Scanning / exploitation attempt

Suspicious outbound

Internal computer → suspicious external IP

Could indicate:

Malware / C2 / data exfiltration

Firewall

A firewall controls traffic using rules.

Example:

ALLOW TCP 443
DENY TCP 23
ALLOW DNS
DENY unknown inbound traffic

A firewall can look at things such as:

• Source IP
• Destination IP
• Port
• Protocol
• Direction

IDS vs IPS

IDS

Intrusion Detection System

Detects suspicious traffic and alerts.

Traffic
  ↓
IDS
  ↓
 ALERT

IPS

Intrusion Prevention System

Can actively block suspicious traffic.

Traffic
  ↓
IPS
  ↓
 BLOCKED

Easy:

IDS = Detect

IPS = Detect + Prevent

NAT

NAT = Network Address Translation

This is why dozens of devices in your home can access the internet using a single public IP.

Example:

Phone       192.168.1.10
Laptop      192.168.1.11
TV          192.168.1.12
                 ↓
              Router
                 ↓
           Public IP
                 ↓
             Internet

The router translates the internal/private addresses to the public address.

ARP

ARP = Address Resolution Protocol

It helps devices on a local network determine:

"Which MAC address belongs to this IP?"

Conceptually:

Who has 192.168.1.20?

        ↓

Device with 192.168.1.20:
"My MAC is AA:BB:CC:DD:EE:FF"

ARP Spoofing

An attacker can send false ARP information.

They might convince a victim:

"I am the router."

Then traffic can potentially be redirected through the attacker.

This is called:

ARP spoofing / ARP poisoning

And it can enable Man-in-the-Middle (MITM) attacks.

Subnet

A subnet divides a larger network into smaller logical networks.

For example:

192.168.1.0/24

might represent a network containing addresses from:

192.168.1.0

through

192.168.1.255

You don't need to become a subnetting wizard yet.

For cybersecurity, understand the concept:

Subnet = logical subdivision of a network.

It helps with:

• Network organization
• Access control
• Segmentation
• Reducing broadcast traffic
• Security boundaries

Network Segmentation

Suppose a company has:

Employee PCs
      |
      ↓
   Network
      |
      ├── HR
      ├── Finance
      ├── Servers
      └── Guest Wi-Fi

You don't want a compromised guest Wi-Fi device casually wandering into the finance servers.

So you separate networks and control traffic between them.

That's:

Network segmentation

It's a major defense against lateral movement.

Put it together: Analyst Scenario

Imagine your SIEM shows:

Source:
192.168.10.45

Destination:
185.x.x.x

Port:
443

Protocol:
TCP

Time:
02:43 AM

What do you know?

Source

Internal machine:

192.168.10.45

Destination

External internet address.

Port

443

Likely HTTPS.

Protocol

TCP.

Time

2:43 AM.

Now here's where the analyst brain kicks in.

Is this normal?

Maybe.

Maybe not.

You investigate:

Who owns 192.168.10.45?

↓

Who was logged in?

↓

What process generated the connection?

↓

What domain was contacted?

↓

Has this IP/domain been associated with malware?

↓

Did the machine make repeated connections?

↓

Did anything execute beforehand?

↓

Was data uploaded afterward?

That's an actual investigation.

Your networking mental model

You should now be able to look at:

192.168.10.45 → 185.x.x.x:443 TCP

and mentally translate it into:

"An internal device communicated with an external IP using TCP on port 443, probably HTTPS."

Mini quiz — don't Google it

Answer these in your own words:

1. What's the difference between an IP address and a MAC address?

2. What does a port identify?

3. What's the main difference between TCP and UDP?

4. What does DNS do?

5. What's the difference between HTTP and HTTPS?

6. What is a packet?

7. What's the difference between inbound and outbound traffic?

8. What's the difference between IDS and IPS?

9. What is NAT used for?

10. If you see:

192.168.1.50 → 8.8.8.8:53 UDP

what do you think is happening?

Give me your answers without worrying about getting them perfect. I'll mark them like a training exercise, correct anything that's wrong, and then we can hit Chapter 3: Windows/Linux fundamentals + logs, which is where cybersecurity analyst work starts getting seriously practical.

Source IP       Source port   Destination IP   Destination port   Protocol
192.0.2.10      51842         198.51.100.20    443                TCP

What is an operating system?

An operating system (OS) manages a computer's:

• Hardware
• Applications
• Files
• Users
• Processes
• Network connections
• Permissions

Two operating systems you'll constantly encounter:

Windows

Linux

Windows vs Linux

Windows

Common in:

• Businesses
• Offices
• Active Directory environments
• Employee laptops
• Enterprise servers

Linux

Common in:

• Web servers
• Cloud infrastructure
• Security tools
• Network appliances
• DevOps
• Databases

As an analyst, you need to be comfortable with both.

What is a process?

A process is a program that is currently running.

For example, you open Chrome.

The operating system starts a process for Chrome.

You open PowerShell.

Another process starts.

You can have:

chrome.exe
powershell.exe
explorer.exe

running simultaneously.

Why do analysts care about processes?

Because attackers need to run something.

Imagine a normal employee computer suddenly starts:

winword.exe
    ↓
powershell.exe
    ↓
cmd.exe
    ↓
suspicious.exe

That's interesting.

Not automatically malicious — but interesting.

The relationship between processes is called a:

Process tree

Parent and Child Processes

Suppose:

explorer.exe
      ↓
powershell.exe
      ↓
something.exe

explorer.exe is the parent process.

powershell.exe is its child process.

Then something.exe is a child of PowerShell.

This relationship can reveal suspicious execution chains.

PowerShell

PowerShell is Microsoft's command-line and scripting environment.

It's legitimate.

Administrators use it constantly.

Attackers also love it.

Why?

Because PowerShell can interact deeply with Windows.

So seeing:

powershell.exe

does not mean:

"MALWARE!!!"

Instead:

"Why was PowerShell executed, by whom, from where, and what did it do?"

That's the analyst mindset.

Linux

Linux has a command-line environment called a shell.

A very common shell is:

Bash

You'll see commands like:

ls
cd
pwd
cat
grep
ps
sudo

You don't need to become a Linux administrator immediately.

You need to understand what you're looking at.

Important Linux Commands

pwd

Shows your current directory.

pwd

Meaning:

Where am I?

ls

Lists files/directories.

ls

cd

Changes directory.

cd /var/log

cat

Displays file contents.

cat logfile.txt

grep

Searches text.

grep "failed" logfile.txt

This one is extremely useful for analysts.

You're essentially saying:

"Show me log entries containing the word failed."

ps

Shows running processes.

ps

sudo

Runs something with elevated privileges.

sudo command

What is a log?

This is the big one.

A log is a record of activity.

For example:

User logged in
File created
Process started
Firewall blocked connection
Password failed
Application crashed

Systems generate logs constantly.

Why are logs important?

Imagine someone claims:

"Nobody accessed the server last night."

You don't need to guess.

You examine the logs.

Maybe you discover:

02:13:44
User: admin
Source IP: 185.x.x.x
Action: Successful login

Logs allow analysts to reconstruct:

What happened?

Types of Logs

You'll encounter many.

Authentication logs

Record login activity.

Examples:

• Successful login
• Failed login
• Password changes
• MFA events

System logs

Record operating-system activity.

Examples:

• Service started
• Service stopped
• System rebooted
• Hardware/software errors

Application logs

Generated by applications.

Examples:

• Login attempt
• API request
• Error
• Database query

Firewall logs

Record network traffic allowed or blocked by a firewall.

Example:

Source: 10.0.0.25
Destination: 185.x.x.x
Port: 443
Action: ALLOW

DNS logs

Record DNS requests.

Example:

Host: workstation-12
Query: suspicious-domain.com
Response: 185.x.x.x

Event vs Alert vs Incident

These three are not the same thing.

Event

Something happened.

Example:

User logged in.

Alert

A security system says:

"This event looks suspicious."

Example:

50 failed login attempts detected.

Incident

After investigation, you determine:

"This is a real security problem."

So:

Event → Alert → Investigation → Incident

An alert isn't automatically an incident.

That's extremely important.

Windows Event Viewer

Windows has a built-in tool called:

Event Viewer

It contains logs from the system.

You can find things such as:

• Security events
• Application events
• System events

Security analysts often investigate Windows events through SIEM platforms rather than manually opening Event Viewer on every computer, but the underlying logs are the same kind of evidence.

Windows Event IDs

Windows assigns numerical IDs to many events.

Some you'll want to recognize:

4624

Successful logon

Meaning:

Someone successfully authenticated.

4625

Failed logon

Meaning:

Authentication failed.

4688

New process created

Meaning:

A process started.

This can be VERY useful during investigations.

4720

User account created

4726

User account deleted

4740

User account locked out

4672

Special privileges assigned to new logon

Potentially interesting because privileged access is involved.

Example Investigation

Suppose your SIEM generates:

Multiple failed logons for account admin.

You investigate.

You find:

Event ID: 4625
Account: admin
Source IP: 185.x.x.x

Then:

Event ID: 4624
Account: admin
Source IP: 185.x.x.x

So you have:

Multiple failed logins

↓

Successful login

That's suspicious.

Now you investigate further.

Look at What Happened After Login

You discover:

4624
Successful login
      ↓
4688
PowerShell started
      ↓
Network connection
      ↓
New account created

Now things are getting spicy.

You might investigate:

• What commands did PowerShell execute?
• What IP did the system contact?
• What account was created?
• What privileges did it receive?
• Did files change?
• Did the attacker move to another machine?

This is how individual logs become an attack story.

Linux Logs

Linux commonly stores logs under:

/var/log/

You'll encounter files such as:

auth.log
syslog
messages

depending on the Linux distribution and logging configuration.

Authentication activity is particularly interesting.

You might find:

Failed password for user admin

Repeated failures from the same external IP?

Potential brute-force activity.

What is a timestamp?

A timestamp tells you when an event occurred.

Example:

2026-11-09 02:14:33

Time matters enormously in investigations.

Imagine:

02:10 — phishing email received
02:13 — suspicious file opened
02:14 — PowerShell started
02:16 — external connection established
02:20 — data transferred

Timeline Analysis

Security analysts often reconstruct incidents chronologically.

For example:

09:01
User receives phishing email

09:03
Attachment opened

09:03
Malicious process starts

09:04
PowerShell executes

09:05
C2 connection established

09:08
Credentials accessed

09:15
Lateral movement begins

09:30
Data exfiltration

That's much more useful than staring at 10,000 disconnected log entries.

Authentication Logs

These are particularly important.

You want to know:

Who logged in?

From where?

When?

Was it successful?

What happened afterward?

For example:

User: shahulan
Source IP: 192.168.1.50
Time: 01:22
Result: SUCCESS

Normal?

Maybe.

But:

User: shahulan
Source IP: Russia
Time: 03:17
Result: SUCCESS

An unfamiliar geographic location can be an investigation lead. Check VPN use, travel, proxy services, and the reliability of geolocation before drawing a conclusion.

Yeah. That's worth investigating.

Log Fields

Logs are usually structured into fields.

Example:

Timestamp:
2026-11-09 03:17:22

User:
admin

Source IP:
185.x.x.x

Destination:
10.0.0.15

Action:
LOGIN

Result:
SUCCESS

Each field provides a piece of the puzzle.

Source vs Destination

You learned this last lesson, but now apply it to logs.

Source

Where activity originated.

Destination

Where activity went.

Example:

Source IP:
10.0.0.25

Destination IP:
185.x.x.x

Destination Port:
443

Translation:

Internal machine 10.0.0.25 communicated externally over TCP/HTTPS.

What is a SIEM?

SIEM = Security Information and Event Management

A SIEM collects logs from many systems into one place.

Instead of checking:

Laptop #1

Laptop #2

Server #1

Firewall

VPN

Email system

Cloud

individually...

You send their logs into the SIEM.

Laptop ────────┐
Server ────────┤
Firewall ──────┤
VPN ───────────┤
Cloud ─────────┼──→ SIEM
Email ─────────┤
EDR ───────────┘

Now analysts can search across everything.

Why SIEMs are powerful

Imagine this attack:

Email system

Shows:

Phishing email delivered.

Endpoint

Shows:

Suspicious PowerShell executed.

DNS

Shows:

Suspicious domain queried.

Firewall

Shows:

Outbound connection established.

Authentication

Shows:

User account accessed another server.

Individually, these might look unrelated.

The SIEM can help correlate them.

Now you have:

One attack story.

That's one of the core jobs of a SOC analyst.

Correlation

Correlation = connecting related events.

Example:

Failed login
      ↓
Successful login
      ↓
PowerShell execution
      ↓
Suspicious DNS request
      ↓
External connection

Each event alone might not prove compromise.

Together?

Very suspicious.

Analyst Mental Model

When looking at logs, ask:

WHO?

Which user/device?

WHEN?

What time?

WHERE?

Source/destination?

WHAT?

What action occurred?

HOW?

What process/protocol/tool was involved?

WHAT NEXT?

What happened immediately afterward?

That final question is crucial.

Mini Investigation

Here's your first proper analyst exercise.

You receive these events:

02:01:12
User: employee01
Event: Failed login
Source IP: 185.44.x.x

02:01:18
User: employee01
Event: Failed login
Source IP: 185.44.x.x

02:01:24
User: employee01
Event: Successful login
Source IP: 185.44.x.x

02:02:01
User: employee01
Event: PowerShell started

02:02:14
Device: WORKSTATION-01
Event: DNS query
Domain: suspicious-example.com

02:02:20
Device: WORKSTATION-01
Event: Outbound connection
Destination: 185.x.x.x
Port: 443

Don't worry about finding the "official" answer. Think like an analyst.

Tell me:

1. Which event is the first thing that makes you suspicious?
2. Why?
3. What would you investigate next?
4. What could the sequence potentially indicate?
5. Would you immediately declare it a confirmed incident? Why or why not?

What is a SOC?

SOC = Security Operations Center

It's the team responsible for monitoring and responding to cybersecurity threats.

A simplified SOC looks like:

                 Security Events
                      ↓
        ┌─────────────────────────┐
        │          SIEM           │
        └────────────┬────────────┘
                     ↓
                  ALERT
                     ↓
              SOC ANALYST
                     ↓
             INVESTIGATION
                     ↓
        ┌────────────┴────────────┐
        ↓                         ↓
   FALSE POSITIVE             INCIDENT
                                  ↓
                             ESCALATION

Your job as an analyst is basically:

Figure out what the hell happened.

What does a SIEM actually do?

SIEM = Security Information and Event Management

A SIEM collects logs from many sources.

For example:

Windows ───────┐
Linux ─────────┤
Firewall ──────┤
VPN ───────────┤
Email ─────────┼──→ SIEM
Cloud ─────────┤
EDR ───────────┤
Applications ──┘

The SIEM then lets you:

• Search logs
• Correlate events
• Create detection rules
• Generate alerts
• Investigate incidents
• Build dashboards
• Track activity

Event vs Alert

This distinction is fundamental.

Event

Something happened.

Example:

User logged in.

That's just an event.

Alert

A security system determines that an event or combination of events deserves attention.

Example:

100 failed logins from one IP

The SIEM might generate:

Possible brute-force attack

That's an alert.

Alert ≠ Incident

This is probably the most important thing in SOC work.

An alert means:

"Something potentially suspicious happened."

It does not automatically mean:

"We have been hacked."

Example:

Alert:
Multiple failed logins

Could be:

Scenario A

Attacker attempting brute force.

Scenario B

Employee repeatedly entering the wrong password.

Scenario C

Automated application misconfigured.

Scenario D

Security scanner performing authorized testing.

Same alert.

Completely different conclusions.

That's why analysts investigate.

Alert Triage

Triage means determining:

How serious is this, and what should I do next?

When an alert arrives, you don't immediately start deleting servers like an overexcited intern.

You first gather information.

Your First Questions

When you receive an alert, ask:

WHO?

Who is involved?

• User
• Account
• Device
• Service

WHAT?

What happened?

• Login?
• Malware?
• Network connection?
• File execution?
• Data transfer?

WHEN?

When did it happen?

WHERE?

Where did it originate?

• IP
• Device
• Country
• Network
• Cloud environment

HOW?

What technique or method was involved?

WHY?

Is there a legitimate explanation?

WHAT HAPPENED BEFORE AND AFTER?

This one is huge.

Example Alert

Your SIEM gives you:

"Multiple failed login attempts detected."

Don't stop there.

You investigate the alert.

You find:

Account:
admin

Failed attempts:
87

Source IP:
185.10.x.x

Time:
02:13–02:18

Target:
Server01

That's suspicious.

Now investigate further.

Investigation Step 1 — Identify the Account

Ask:

Who owns admin?

Is it:

• Human?
• Service account?
• Administrator?
• Shared account?

If it's a normal employee account, that's one situation.

If it's a domain administrator, suddenly the priority increases.

Investigation Step 2 — Identify the Source

Where did the attempts come from?

185.10.x.x

Is it:

• Internal?
• External?
• Known VPN?
• Corporate office?
• Cloud provider?
• Known malicious IP?

Never assume an IP is malicious simply because it looks weird.

Context matters.

Investigation Step 3 — Look at Timing

Suppose:

02:13
Failed login

02:14
Failed login

02:15
Failed login

02:16
Failed login

02:17
Successful login

That's considerably more interesting than:

Failed login

Then:

successful authentication after repeated failures

is a major investigation point.

Investigation Step 4 — Look for What Happened Next

Suppose after successful login:

02:17
Successful login

02:18
PowerShell launched

02:19
New account created

02:20
Connection to external IP

02:22
Large data transfer

Now you're looking at a potential attack chain.

That's why analysts don't investigate alerts in isolation.

Severity

Alerts are usually assigned a severity.

Common levels:

Informational

Probably nothing serious.

Low

Minor suspicious activity.

Medium

Potentially meaningful security event.

High

Likely serious security issue.

Critical

Potentially severe compromise/impact.

Different organizations use different scoring systems.

Don't assume "High" automatically means confirmed compromise.

Severity is about the risk/importance of the alert, not necessarily certainty.

False Positive

A false positive occurs when a security system flags something suspicious that turns out to be legitimate.

Example:

Your SIEM detects:

"Massive login activity."

You investigate.

Turns out the company deployed a new application that automatically authenticates thousands of users.

Not an attack.

False positive.

True Positive

A true positive means the detection correctly identified suspicious/malicious activity.

Example:

Alert:

Suspicious PowerShell execution.

Investigation finds:

• Unknown script
• Malicious download
• C2 connection
• Unauthorized account

That's a true positive.

False Negative

This is nastier.

A false negative occurs when malicious activity happens but isn't detected.

Example:

Attacker compromises an account.

SIEM generates no alert.

Nobody notices for six months.

That's a detection failure.

Detection Rules

A SIEM needs rules to decide when something deserves attention.

For example:

IF
failed_login_count > 20
FROM same IP
WITHIN 5 minutes

THEN
generate alert

That's a basic detection rule.

Another:

IF
PowerShell starts
AND
downloads executable
AND
connects to suspicious external domain

THEN
generate high-severity alert

This is where security analysts start getting into detection engineering.

Correlation Rules

A powerful SIEM can correlate multiple events.

For example:

Failed Login
      +
Successful Login
      +
PowerShell
      +
Suspicious DNS
      +
External Connection

Instead of creating five unrelated alerts, the SIEM can recognize the combination.

That is correlation.

IOC

Now you'll start hearing this constantly.

IOC = Indicator of Compromise

An IOC is evidence associated with potentially malicious activity.

Examples:

IP address

185.x.x.x

Domain

malicious-example.com

File hash

SHA256:
a7c91f...

Filename

invoice.exe

Registry key

Potentially associated with persistence.

Suspicious account

Potentially compromised identity.

IOA

IOA = Indicator of Attack

Instead of focusing on a specific piece of evidence, you're looking at attacker behavior.

Example:

PowerShell downloads a script → executes it → establishes an outbound connection.

That's behavior.

This is useful because attackers can change:

• IP addresses
• File names
• Domains
• Malware hashes

But their behavior may remain recognizable.

IOC vs IOA

Think:

IOC = What evidence did they leave?

IOA = What behavior are they performing?

Example:

IOC:

Malicious IP 185.x.x.x

IOA:

Repeated outbound connections to an external server every 60 seconds.

TTP

TTP = Tactics, Techniques, and Procedures

This describes how attackers operate.

Tactic

What is the attacker trying to accomplish?

Example:

Credential Access

Technique

How are they doing it?

Example:

Credential Dumping

Procedure

The specific implementation they used.

This terminology becomes especially important when working with MITRE ATT&CK.

MITRE ATT&CK

Think of MITRE ATT&CK as a giant map of attacker behavior.

For example:

Initial Access
      ↓
Execution
      ↓
Persistence
      ↓
Privilege Escalation
      ↓
Credential Access
      ↓
Discovery
      ↓
Lateral Movement
      ↓
Collection
      ↓
C2
      ↓
Exfiltration

When investigating an attack, you can map observed behavior to ATT&CK techniques.

That helps analysts communicate what actually happened.

Analyst Workflow

Here's a realistic simplified workflow:

Step 1

Alert arrives

↓

Step 2

Validate the alert

Is it real or noise?

↓

Step 3

Collect evidence

Logs, endpoint telemetry, network data, user activity.

↓

Step 4

Build a timeline

What happened before/during/after?

↓

Step 5

Determine scope

One machine?

One user?

Entire organization?

↓

Step 6

Determine severity

Low?

Medium?

High?

Critical?

↓

Step 7

Contain/escalate if necessary

↓

Step 8

Document everything

Documentation

Don't underestimate this.

A SOC analyst needs to be able to write:

What happened?

What evidence supports it?

What systems/users were affected?

What actions were taken?

What remains unknown?

Bad:

"Looks hacked."

Good:

"Account employee01 experienced 43 failed authentication attempts from external IP X between 02:10–02:13 UTC, followed by a successful authentication. Shortly afterward, PowerShell executed on WORKSTATION-01 and the host established an outbound connection to domain Y. Investigation is ongoing."

The second one can actually be used by another analyst.

Escalation

You don't have to solve every incident yourself.

Junior analyst might discover:

"This appears to be an actual compromise."

Then escalate to:

• Tier 2 analyst
• Incident response team
• Threat hunter
• Security engineer
• SOC manager

depending on the organization.

Escalating isn't failing.

Failing is sitting on a confirmed compromise because you're afraid to bother someone senior.

Your First SOC Investigation

Alert

Suspicious PowerShell Activity

You have these events:

10:02:11
User: employee01
Event: Microsoft Word opened
File: Invoice.docm

10:02:14
Process: powershell.exe
Parent: WINWORD.EXE

10:02:16
PowerShell:
Downloads file from external domain

10:02:20
Process:
invoice.exe

10:02:22
DNS:
random-example.com

10:02:23
Outbound:
10.0.5.21 → 185.x.x.x:443

10:02:25
User:
employee01
Event:
Successful login to SERVER01

Now don't jump straight to "confirmed malware."

Work it like an analyst.

Your job:

1. What is the first suspicious event?

2. What makes the PowerShell activity suspicious?

3. Why is WINWORD.EXE → powershell.exe worth investigating?

4. What evidence would you want next?

5. What could the attack chain potentially be?

6. Which stage(s) of the attack lifecycle might be occurring?

7. Would you classify this as a false positive, suspicious activity, or confirmed incident based only on this evidence?

8. What would you do next as the analyst?

Take your time and answer it like you're sitting in a SOC.

Once you nail this, Chapter 5 is Windows security + Event IDs + PowerShell investigation, where I'll show you how to read actual Windows security events and start building an attack timeline from them.

Why Windows matters

Most organizations use Windows across employee computers, laptops and servers.

Attackers know this. They often exploit Windows features that administrators and employees use every day.

As an analyst, you'll investigate things like:

• Who logged into a computer?
• Was the login successful?
• Which programs were executed?
• Did someone create a new account?
• Was PowerShell used suspiciously?
• Did an attacker gain administrative privileges?

Your primary evidence often comes from Windows Event Logs.

Windows Event Viewer

Windows Event Viewer records activities happening on a computer.

To open it:

1. Press Win + R.
2. Type eventvwr.msc.
3. Press Enter.
4. Expand Windows Logs.
5. Select Security.

You'll find records of authentication, account changes, permissions and other security-related activity.

The four important log categories

Important Windows Event IDs

These are worth learning. You'll encounter them in SOC investigations.

Important: An event ID alone does not prove an attack. You need context.

For example, Event 4720 could be a legitimate HR administrator creating an employee account.

Understanding process execution

This is one of the most important skills in endpoint investigation.

A process is a program currently running.

Examples:

• explorer.exe — Windows File Explorer
• winword.exe — Microsoft Word
• powershell.exe — PowerShell
• cmd.exe — Command Prompt
• chrome.exe — Google Chrome
• svchost.exe — Windows service host

Parent and child processes

Imagine this:

<caption>Microsoft Word opened by employee</caption>

<caption>Child process launched by Word</caption>

<caption>Downloaded executable launched by PowerShell</caption>

This is called a process tree.

Why is this suspicious?

Microsoft Word normally shouldn't need to launch PowerShell, download an executable and run it.

This could indicate a malicious document containing a macro or another form of code execution.

But remember: suspicious doesn't automatically mean malicious.

PowerShell investigation

PowerShell is a Windows command-line and scripting environment.

Administrators use it for legitimate tasks. Attackers also abuse it because it can:

• Execute scripts.
• Download files.
• Create users.
• Modify system settings.
• Interact with network resources.
• Run commands without opening traditional applications.

Commands you should recognize

These are primarily investigative or administrative commands.

Suspicious PowerShell patterns

An analyst should pay attention to commands involving:

• Encoded commands.
• Downloading scripts from unknown domains.
• Hidden or unusual execution.
• Unexpected execution under privileged accounts.
• Commands launched by unusual parent processes.

For example, -EncodedCommand is not automatically malicious, but it deserves investigation when combined with suspicious behavior.

Building an attack timeline

A cybersecurity analyst needs to reconstruct events in chronological order.

Consider this fictional investigation:

A possible interpretation:

1. Initial access — malicious attachment opened.
2. Execution — PowerShell runs.
3. Payload delivery — executable downloaded.
4. Command and control — external communication established.
5. Persistence — new account potentially created.
6. Lateral movement — access to another server potentially obtained.

These are possible attack stages, not confirmed conclusions. You need supporting evidence for each.

Practical analyst investigation

When you investigate suspicious Windows activity, collect:

• Username and account privileges.
• Computer hostname.
• Event ID and timestamp.
• Parent and child process names.
• Process command line.
• File path and SHA-256 hash.
• Source and destination IP addresses.
• DNS queries and network connections.
• Related logins and account changes.

Then ask:

What happened before the suspicious activity, during it, and after it?

That's how you turn disconnected logs into an investigation.

Your Chapter 5 practical examination

You're the SOC analyst. Your SIEM generates an alert:

One final challenge: Beyond the multiple-choice questions, explain in your own words how an attacker could go from failed logins to creating a privileged account.

What exactly is malware?

Malware means malicious software. It's software designed to harm systems, steal information, disrupt operations or gain unauthorized access.

Not every suspicious program is malware. Analysts examine its behaviour and evidence before making that conclusion.

The main types of malware

  Encrypts files or systems and demands payment to restore access.
  <text color="secondary" size="xs">Example: Files become inaccessible and a ransom note appears.</text>
</box>

  Malicious software disguised as legitimate software.
  <text color="secondary" size="xs">Example: A fake invoice application that secretly installs malware.</text>
</box>

  Malware that can spread between systems, often without requiring users to manually execute it on every device.
</box>

  Secretly monitors activity and collects information.
</box>

  Records keyboard input, potentially capturing passwords and sensitive information.
</box>

  Gives an attacker remote access to a compromised system.
</box>

  A collection of compromised devices controlled by an attacker.
</box>

Other terms worth knowing:

• Rootkit: Hides malicious activity and maintains privileged access.
• Backdoor: A hidden method of accessing a system.
• Dropper: Delivers or installs another malicious component.
• Loader: Loads additional malware into a system.
• Cryptojacker: Secretly uses computing resources to mine cryptocurrency.

How malware infects a computer

Let's walk through a realistic example.

An employee receives an email:

The employee opens the attachment.

A possible sequence:

• Initial access

  Attacker delivers a malicious attachment.
  

• Execution

  The document triggers malicious code.
  

• Payload delivery

  Malware is downloaded onto the computer.
  

• Persistence

  Malware attempts to survive a reboot or maintain access.
  

• Command and control

  The infected device communicates with attacker-controlled infrastructure.
  

• Impact

  The attacker may steal data, encrypt files or disrupt operations.
  

This is one possible attack chain, not a mandatory sequence. Real attacks can skip, repeat or reorder stages.

Static vs dynamic malware analysis

This is a major distinction in cybersecurity.

Static analysis means examining a file without executing it.

Examples:

• Calculate its SHA-256 hash.
• Examine file metadata.
• Inspect strings contained in the file.
• Check its file type.
• Examine its structure and signatures.

Dynamic analysis means observing what a file does while it executes in a controlled environment.

Examples:

• Does it create new files?
• Does it modify the registry?
• Does it launch PowerShell?
• Does it connect to an external server?
• Does it create new user accounts?

What is a sandbox?

A sandbox is an isolated environment used to examine suspicious files without exposing normal production systems.

Important: Never experiment with unknown malware on your personal laptop. Use an appropriately isolated lab or professional analysis environment.

Hashes and Indicators of Compromise

A hash is a fixed-length value generated from data using a hashing algorithm.

Think of it as a digital fingerprint of a file.

Example:

File: invoice.exe

SHA256:
a3f5c8d9e1b7...

Even a small change to the file will generally produce a different hash.

Common algorithms:

• MD5
• SHA-1
• SHA-256

For security investigations, SHA-256 is generally preferred over MD5 and SHA-1.

What is an IOC?

IOC = Indicator of Compromise.

Examples:

An IOC helps an analyst identify evidence associated with a possible compromise.

But an IOC is not absolute proof. IP addresses can be shared, domains can change ownership, and files can be modified.

MITRE ATT&CK — Your attacker's behaviour map

is a knowledge base documenting how real-world attackers behave.

Instead of simply saying:

"Someone hacked the computer."

You can describe the observed behaviour using standardized tactics and techniques.

The difference between tactics, techniques and procedures

• Tactic: What is the attacker trying to achieve?
• Technique: How are they trying to achieve it?
• Procedure: How did they actually perform it?

Example:

Enterprise ATT&CK tactics

These are the main tactic categories you'll encounter:

You don't need to memorize every technique today. Understand what each tactic represents.

Malware investigation tools

These are useful tools to recognize as a SOC analyst.

  Examines network traffic and packets.

  <a href="https://www.wireshark.org/">Official website</a>
</box>

  Checks files, hashes, domains and IP addresses against multiple security engines.

  <a href="https://www.virustotal.com/">Official website</a>
</box>

  Examines running processes and their relationships.

  <a href="https://learn.microsoft.com/en-us/sysinternals/">Microsoft Sysinternals</a>
</box>

  Interactive malware analysis sandbox.

  <a href="https://any.run/">Official website</a>
</box>

  Records detailed system activity, including process creation and network connections.

  <a href="https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon">Official documentation</a>
</box>

One warning: Don't upload confidential company documents, private data or sensitive files to public analysis services such as VirusTotal without authorization.

Practical SOC investigation

Now let's put everything together.

Suspected Malware Infection

User: employee02

Investigation timeline:

Knowledge check

One question without multiple choice

Imagine you're writing an incident report to your security manager.

Explain what happened in this investigation from the first suspicious event to the final data transfer. Identify at least three MITRE ATT&CK tactics and explain why you chose them.

What is a vulnerability?

A vulnerability is a weakness in software, hardware, configurations or security procedures that could be exploited.

Examples:

• An outdated Windows operating system.
• A web application with SQL injection.
• A server using weak passwords.
• An exposed database.
• A router running outdated firmware.
• An incorrectly configured firewall.

Think of a company building a house.

• The house = IT infrastructure.
• The unlocked window = vulnerability.
• The burglar = threat actor.
• Breaking through the window = exploit.
• The stolen property = impact.

Your job is to help identify and reduce those weaknesses.

Vulnerability vs Threat vs Exploit vs Risk

These terms are related, but they are NOT interchangeable.

Example:

A company's server has an outdated application.

• Vulnerability: The application contains a security flaw.
• Threat: A cybercriminal may target the server.
• Exploit: The attacker uses the flaw to gain unauthorized access.
• Risk: Company information could be stolen.
• Remediation: Update the application to a secure version.

What is CVE?

stands for Common Vulnerabilities and Exposures.

It is a system that gives publicly known cybersecurity vulnerabilities standardized identification numbers.

For example:

CVE-2021-44228

This identifies the famous Log4Shell vulnerability.

A CVE identifier usually follows this format:

CVE-YEAR-NUMBER

CVE-2021-44228
│   │    │
│   │    └── Unique identifier
│   └─────── Year assigned
└─────────── CVE prefix

Why does CVE matter?

Imagine a company uses 500 different applications.

Instead of describing a vulnerability in a different way every time, security teams can use its CVE identifier to find information about the same vulnerability.

You can investigate CVEs through:

• CVE official website
• NIST National Vulnerability Database

What is CVSS?

stands for Common Vulnerability Scoring System.

It provides a standardized way to measure the severity of a vulnerability.

The CVSS score ranges from 0.0 to 10.0.

Example

Imagine you discover two vulnerabilities:

Which one should the security team prioritize?

Usually A.

But here's something important:

CVSS severity is not the same as business risk.

A critical vulnerability on an isolated test computer might be less urgent than a high-severity vulnerability on an internet-facing production server containing sensitive customer information.

You must consider:

• How exposed is the system?
• Is there a known active exploit?
• Does the organization use the affected software?
• What data does the system contain?
• What would happen if it were compromised?

What is a zero-day vulnerability?

A zero-day vulnerability is a security flaw for which the affected vendor has had zero days to provide a fix at the point it is exploited or disclosed.

In practice, the term is commonly used for vulnerabilities exploited before a patch is available.

Example:

A hacker discovers an unknown weakness in a company's operating system and exploits it before the vendor releases a security update.

Why is it dangerous?

• No official patch may exist.
• Traditional security controls may not detect it.
• Organizations may not know they're vulnerable.
• Attackers may exploit it before defenders can respond.

Possible temporary protections include:

• Disabling the affected service.
• Restricting network access.
• Applying security workarounds.
• Increasing monitoring.
• Deploying compensating controls.

Vulnerability scanning vs penetration testing

These are two different activities.

Identifies known weaknesses and misconfigurations.

Safely tests whether weaknesses can actually be exploited within an authorized scope.

A vulnerability scanner might report that a server has a vulnerable version of software.

A penetration tester may demonstrate whether that weakness allows unauthorized access.

Neither activity guarantees that every vulnerability has been found.

Patch management

A patch is a software update that fixes bugs, security vulnerabilities or other problems.

Patch management is the process of identifying, testing, approving and deploying updates.

Typical patch management lifecycle

• Identify

  Find outdated or vulnerable software.
  

• Assess

  Determine severity, exposure and business impact.
  

• Prioritize

  Decide which vulnerabilities need attention first.
  

• Test

  Test the patch in a controlled environment.
  

• Deploy

  Install the approved patch on affected systems.
  

• Verify

  Confirm the patch was successfully installed and the vulnerability is addressed.
  

• Document

  Record the changes, results and remaining risks.
  

Why not install every patch immediately?

Because updates can sometimes break applications, interrupt operations or cause compatibility issues.

For example, an airport operations system cannot simply be taken offline during critical operations without considering operational safety.

That's why patching requires planning and risk assessment.

Vulnerability management tools

These are worth recognizing as a cybersecurity analyst.

  Scans systems for vulnerabilities and configuration weaknesses.

  <a href="https://www.tenable.com/products/nessus">Official website</a>
</box>

  Open-source vulnerability scanning technology.

  <a href="https://www.greenbone.net/">Official website</a>
</box>

  Cloud-based vulnerability and security management platform.

  <a href="https://www.qualys.com/">Official website</a>
</box>

  Helps identify, assess and prioritize weaknesses across an organization's devices.

  <a href="https://learn.microsoft.com/en-us/defender-vulnerability-management/">Official documentation</a>
</box>

Practical case study — Your first vulnerability report

You're working as a security analyst for a fictional airport company.

Your vulnerability scanner produces this report:

Knowledge check

Analyst assignment

Forget the multiple choice for a moment.

Imagine your manager asks:

"We discovered a critical vulnerability on an airport operations server. What would you recommend, and why?"

Give me your response as if you're actually the security analyst.

1. The immediate risks.
2. Why the vulnerability needs urgent attention.
3. What mitigation you recommend.
4. How you would verify the fix.
5. What you would tell management.

Next: Chapter 8 — Active Directory, Identity Management, Authentication, Kerberos & Privilege Escalation.

What is Identity and Access Management (IAM)?

IAM stands for Identity and Access Management.

It controls:

• Who can access an organization's systems.
• What resources they can access.
• What actions they're allowed to perform.
• How their identity is verified.

Imagine an airport company with 200 employees.

Not everyone should have access to everything.

This is IAM in practice.

Authentication vs Authorization

These two terms are essential.

• Authentication (AuthN): Proves who you are.
• Authorization (AuthZ): Determines what you're allowed to do.

Example:

You log into a company system using your username and password.

That's authentication.

The system allows you to view your own employee records but not payroll records belonging to everyone else.

That's authorization.

What is Active Directory?

(AD) is Microsoft's directory service used by organizations to manage users, computers, groups and permissions in a Windows domain.

Instead of configuring every employee computer individually, administrators can centrally manage them.

For example, an organization might have:

COMPANY.LOCAL
│
├── Users
│   ├── Shahulan
│   ├── Ahmed
│   └── Mohamed
│
├── Groups
│   ├── HR
│   ├── Finance
│   ├── Operations
│   └── IT Administrators
│
├── Computers
│   ├── HR-PC-01
│   ├── OPS-PC-01
│   └── FIN-PC-01
│
└── Servers
    ├── FILE-SERVER
    ├── HR-SERVER
    └── DOMAIN-CONTROLLER

This is a simplified illustration of an organization's directory structure.

Important Active Directory terminology

Important: A Domain Controller is one of the most sensitive systems in a Windows domain. Compromising it can put the entire domain at risk.

What is the principle of least privilege?

This is one of the most important security principles.

Least privilege means giving users only the permissions necessary to perform their jobs.

Imagine an employee working in airport operations.

They need access to their shift schedule and operational applications.

They do not need:

• Access to payroll administration.
• Permission to create domain administrators.
• Access to every employee's medical records.
• Permission to modify domain-wide security policies.

Why?

Because if their account gets compromised, the attacker's available permissions are limited.

This is also why administrators should avoid using their privileged accounts for everyday activities.

What is Kerberos?

is an authentication protocol commonly used in Windows Active Directory environments.

It allows users and services to authenticate without repeatedly sending their passwords across the network.

Think of it as a digital ticket system.

The three important components

The KDC runs on a Domain Controller in a typical Active Directory environment.

How Kerberos authentication works

<caption>Employee authenticates using their domain credentials.</caption>

<caption>Verifies authentication and issues a Ticket Granting Ticket (TGT).</caption>

<caption>KDC issues a Ticket Granting Service ticket (TGS) for the requested service.</caption>

<caption>The service validates the ticket and applies its access permissions.</caption>

Two terms you absolutely need to remember:

• TGT: Ticket Granting Ticket. Used to request access tickets for services.
• TGS: Ticket Granting Service ticket. Used to access a particular network service.

Why does a SOC analyst care?

Because unusual Kerberos activity can indicate:

• Password attacks.
• Credential theft.
• Attempts to obtain service account credentials.
• Unauthorized access to domain resources.
• Attempts to forge authentication tickets.

We'll look at those attacks shortly.

NTLM vs Kerberos

Both are Windows authentication mechanisms.

A SOC analyst should recognize both because attackers may abuse weaknesses in authentication systems.

Important identity security technologies

These are common terms you'll see in security reports and job interviews.

MFA — Multi-Factor Authentication

MFA requires more than one type of verification.

The three common factor categories:

1. Something you know — password or PIN.
2. Something you have — security key or authenticator device.
3. Something you are — fingerprint or facial recognition.

For example:

• Username and password.
• Then a verification through an authenticator app.

Even if an attacker steals the password, MFA can make account compromise harder.

However, MFA isn't invincible. Attackers may use phishing, stolen session tokens or MFA fatigue attacks.

RBAC — Role-Based Access Control

Permissions are assigned based on a person's role.

For example:

• HR role → HR systems.
• Finance role → Finance systems.
• Operations role → Operations systems.

PAM — Privileged Access Management

PAM helps organizations control highly privileged accounts.

It can provide:

• Controlled administrator access.
• Temporary privilege elevation.
• Credential vaulting.
• Session monitoring.
• Audit trails.

Think of PAM as extra security around the keys to the kingdom.

How attackers abuse Active Directory

Attackers often target identities because compromising an account can be easier than directly breaking into a protected system.

Attack 1 — Brute force

An attacker repeatedly tries different passwords against an account.

Example:

employee01 — password attempt 1
employee01 — password attempt 2
employee01 — password attempt 3
employee01 — password attempt 4
employee01 — password attempt 5

Analyst indicators:

• Numerous failed logins.
• Repeated attempts against one account.
• Unusual source IP addresses.
• Attempts outside normal working hours.

Attack 2 — Password spraying

Instead of trying hundreds of passwords against one account, an attacker tries a small number of common passwords across many accounts.

Example:

employee01 → Password123
employee02 → Password123
employee03 → Password123
employee04 → Password123

This can help attackers avoid account lockout policies.

Analyst indicators:

• One source IP targeting many accounts.
• Similar login failures across different users.
• Unusual authentication patterns.

Attack 3 — Credential stuffing

Attackers use previously leaked username/password combinations against other services.

Why does this work?

Because some people reuse passwords across websites.

Analyst indicators:

• Login attempts from unfamiliar locations.
• Multiple accounts targeted.
• Successful logins following repeated failures.
• Unusual access patterns.

Attack 4 — Pass-the-Hash

This is an authentication attack involving the abuse of stolen password hashes.

A password hash is not the original password. However, certain Windows authentication mechanisms can allow attackers to authenticate using stolen hash material without knowing the plaintext password.

Analyst indicators:

• Suspicious privileged authentication.
• Unexpected access to multiple computers.
• Unusual authentication patterns involving NTLM.
• Evidence of credential dumping.

Attack 5 — Kerberoasting

Kerberoasting targets service accounts associated with Service Principal Names (SPNs).

At a high level:

1. An attacker gains access to a domain account.
2. They request service tickets for accounts with SPNs.
3. They obtain ticket material.
4. They attempt offline password cracking.
5. Weak service account passwords may be recovered.

Why is this dangerous?

Service accounts sometimes have excessive permissions or weak, long-standing passwords.

Analyst indicators:

• Unusual volumes of service ticket requests.
• Requests involving numerous SPNs.
• Unexpected activity from ordinary user accounts.
• Suspicious authentication patterns.

Attack 6 — Golden Ticket

A Golden Ticket attack involves forging Kerberos Ticket Granting Tickets using compromised domain Kerberos secrets, particularly the krbtgt account's key.

This is extremely serious because it can allow an attacker to impersonate domain identities.

Analyst indicators:

• Suspicious or anomalous Kerberos tickets.
• Unusual ticket lifetimes or authentication patterns.
• Unexpected privileged domain access.
• Other evidence of Domain Controller compromise.

Attack 7 — MFA fatigue

An attacker repeatedly sends authentication approval requests to a victim, hoping the person eventually approves one out of frustration.

Analyst indicators:

• Numerous MFA requests.
• Repeated denied requests.
• Unexpected approval.
• Successful login immediately afterward.

Windows Event IDs for identity investigations

You already learned some Windows Event IDs in Chapter 5. Let's expand that knowledge.

Remember: An event is evidence of an action, not proof of malicious intent.

For example, Event 4728 could indicate that an administrator legitimately added a new employee to a security group.

But if an ordinary employee account suddenly adds itself to a privileged group, that's worth investigating.

How to investigate a compromised employee account

Imagine your SIEM generates this alert:

Your investigation workflow

• Identify the account

  Who owns employee04? Is this activity expected?
  

• Investigate authentication

  Examine failed and successful logins, source IPs, locations and authentication methods.
  

• Investigate privilege changes

  Who added employee04 to the Administrators group? Was it authorized?
  

• Investigate lateral movement

  Why did employee04 access FILE-SERVER? Which systems were accessed?
  

• Investigate data access

  Which files were accessed? Was anything copied or transferred externally?
  

• Contain and escalate

  Follow incident response procedures. Coordinate account restriction, credential resets, endpoint isolation and evidence preservation as appropriate.
  

How organizations defend Active Directory

A good security analyst should understand attacks and their countermeasures.

Some additional concepts:

• Microsoft Entra ID: Microsoft's cloud identity and access management platform.
• Conditional Access: Applies access rules based on conditions such as device, location and risk.
• LAPS: Helps manage and rotate local administrator passwords.
• gMSA: Group Managed Service Account; supports managed service account passwords.
• Protected Users: An Active Directory security group that applies additional protections to privileged authentication.

Practical examination — Active Directory attack

You're a SOC analyst at a company with 300 employees.

Your SIEM detects the following:

Test your knowledge

Analyst assignment

This time, no multiple-choice answers.

Your security manager asks:

"An employee's account was compromised. The attacker accessed a file server and added the account to a privileged security group. What happened, how serious is it, and what would you do?"

Explain:

1. How the attacker might have obtained access.
2. Why the privileged group change is dangerous.
3. What lateral movement means in this case.
4. What evidence you would collect.
5. How you would contain the incident.
6. How you would prevent it happening again.

What is an endpoint?

An endpoint is a device connected to an organization's network.

Examples:

• Desktop computers.
• Laptops.
• Servers.
• Workstations.
• Mobile devices.
• Virtual machines.

Imagine an airport company:

Why are endpoints important?

Because attackers frequently target employee devices to gain access to an organization's systems.

If an attacker compromises an employee's laptop, they might attempt to steal credentials, execute malware, or access other systems.

What is EDR?

EDR stands for Endpoint Detection and Response.

EDR software monitors endpoint activity to detect, investigate and respond to potential security threats.

Think of it as a security monitoring system installed across company computers and servers.

What does EDR monitor?

EDR collects endpoint telemetry and uses detection logic to identify suspicious behaviour.

What can EDR do?

• Detect suspicious processes.
• Identify malware.
• Investigate process relationships.
• Alert security analysts.
• Isolate compromised devices.
• Quarantine malicious files.
• Terminate suspicious processes, where supported.
• Collect investigation evidence.

Important: EDR doesn't magically prevent every cyberattack. It helps defenders detect and respond to threats.

EDR vs Traditional Antivirus

This distinction matters in interviews.

Primarily identifies and blocks known malicious files and other threats using signatures and additional detection techniques.

Collects endpoint activity, detects suspicious behaviour and supports investigation and response.

Modern antivirus products can also have behavioural detection and response features. The distinction is about capabilities, not a strict boundary.

What is XDR?

XDR stands for Extended Detection and Response.

EDR focuses primarily on endpoints.

XDR brings together security information from multiple sources.

Imagine an organization using:

• Endpoint security.
• Email security.
• Network security.
• Cloud security.
• Identity security.

An XDR platform can correlate information from these different systems to help analysts see the bigger picture.

EDR vs XDR

Example:

An employee receives a phishing email.

1. Email security detects a suspicious attachment.
2. EDR detects Word launching PowerShell.
3. Identity security detects unusual login activity.
4. Network security detects suspicious outbound traffic.
5. XDR correlates the events into a broader incident.

Instead of investigating five unrelated alerts, the analyst can investigate one connected attack story.

What is endpoint telemetry?

This is a term you'll hear constantly.

Telemetry is information collected about system activity.

EDR can collect information such as:

• Process creation.
• Parent and child processes.
• Command-line arguments.
• File creation and modification.
• Network connections.
• User activity.
• Registry modifications.
• Security events.

Example: Process tree

An analyst investigates:

1. Which user started the process?
2. What was the parent process?
3. What command-line arguments were used?
4. Where did the executable come from?
5. What is its SHA-256 hash?
6. Did it communicate externally?
7. Did it create persistence mechanisms?

This is called endpoint investigation.

Behavioural detection

Modern security systems don't only look for known malware files. They also look for suspicious behaviour.

For example, PowerShell is a legitimate Windows tool.

But consider these two situations:

Same program. Very different context.

This is why analysts examine behaviour, relationships and surrounding events.

Important detection terms

What is a false positive?

An EDR alerts because an administrator runs a legitimate script.

The alert looks suspicious, but investigation shows it was approved maintenance.

That's a false positive.

What about a false negative?

Malicious activity occurs, but the security system fails to detect it.

That's a false negative.

Both matter. Too many false positives overwhelm analysts; false negatives allow threats to go unnoticed.

EDR response capabilities

Detection is only half the job. EDR also supports response.

Here are common response actions:

  Disconnects an endpoint from normal network communications while preserving an approved management connection where supported.
</box>

  Prevents a suspicious file from being accessed or executed.
</box>

  Stops a suspicious running process.
</box>

  Coordinates account disabling, session revocation or credential resets when compromise is suspected.
</box>

  Collects relevant endpoint information for further investigation.
</box>

A serious warning: Isolating a device can interrupt business operations. Imagine isolating an airport operations workstation during an active flight operation. You need to coordinate with the incident response team and operational management, follow established procedures and consider safety-critical dependencies.

EDR and XDR platforms you should recognize

These are widely used products and platforms in the cybersecurity industry.

  Endpoint detection, investigation and response.

  <a href="https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-endpoint">Official website</a>
</box>

  Endpoint protection, EDR and extended security capabilities.

  <a href="https://www.crowdstrike.com/platform/">Official website</a>
</box>

  Endpoint protection, detection and response.

  <a href="https://www.sentinelone.com/platform/">Official website</a>
</box>

  Extended detection and response across connected security data sources.

  <a href="https://www.paloaltonetworks.com/cortex/cortex-xdr">Official website</a>
</box>

You don't need to master every platform immediately. The investigation concepts transfer between products.

How a SOC analyst investigates an EDR alert

Here's a workflow worth learning:

A good analyst doesn't blindly click the quarantine button whenever an alert appears. They establish what's happening, assess the impact and choose an appropriate response.

Practical SOC investigation — Case EDR-009

You're working in a SOC for a company operating 150 computers.

Your EDR platform generates this alert:

Knowledge check

Analyst assignment

Forget the quiz for a moment.

Your manager asks:

"We detected suspicious PowerShell activity on two employee computers. One computer downloaded an unknown executable, created a scheduled task and contacted an external IP. What do you recommend?"

Explain:

1. What makes the activity suspicious?
2. What evidence would you collect?
3. Why should you investigate the second computer?
4. Would you isolate the affected computers? Explain your decision.
5. How would you determine whether data was stolen?
6. How would you prevent another infection?

What is Incident Response?

Incident Response (IR) is the organized process of identifying, investigating, containing, removing and recovering from cybersecurity incidents.

Imagine an employee opens a malicious attachment.

The malware steals credentials, compromises a server and begins transferring company information.

The security team must:

1. Detect the attack.
2. Determine what happened.
3. Stop it from spreading.
4. Remove the threat.
5. Restore affected systems.
6. Learn how to prevent it happening again.

That entire process is incident response.

What is a security incident?

A security incident is an event, or series of events, that compromises or threatens the confidentiality, integrity or availability of information or systems.

Examples:

• Ransomware infection.
• Unauthorized account access.
• Data theft.
• Malware execution.
• Compromised administrator account.
• Unauthorized changes to critical systems.
• Denial-of-service attack.

Remember the distinction:

Not every alert is an incident.

The Incident Response Lifecycle

A widely used incident response approach is described in NIST guidance.

The following six phases provide a practical learning model:

Important: NIST's current incident response guidance integrates incident response across broader cybersecurity risk management. These six phases are a useful teaching framework, not a claim that every organization follows one identical sequence.

Understanding Containment

Containment deserves special attention.

Why?

Because an attacker who has compromised one computer may attempt to spread to other computers.

Imagine this:

<caption>Security team isolates the affected endpoint and investigates other systems.</caption>

Three types of containment

1. Endpoint containment

Isolate an infected computer using EDR.

2. Network containment

Restrict communication with malicious IP addresses, domains or affected network segments.

3. Identity containment

Disable compromised accounts, revoke active sessions or reset credentials as appropriate.

Short-term vs long-term containment

A crucial lesson: containment must be planned. You don't blindly disconnect critical infrastructure without considering business and safety consequences.

For example, an airport operations system may support active operational activities. Any containment decision must involve the appropriate operational and security teams.

Incident Severity Classification

Not every incident has the same level of seriousness.

Security teams classify incidents to determine how quickly and carefully they need to respond.

Severity depends on several factors:

• Number of affected systems.
• Sensitivity of information.
• Business impact.
• Whether the attacker has administrator privileges.
• Whether the attack is ongoing.
• Whether data has been stolen.
• Whether essential services are disrupted.

Remember: Severity and confidence are different.

You might have a high-severity alert with low confidence, or a confirmed incident with medium business impact.

Digital Evidence and Chain of Custody

When investigating a cyberattack, evidence matters.

You cannot simply tell management:

"Trust me, someone hacked the system."

You need records supporting your findings.

Common digital evidence

What is chain of custody?

Chain of custody is the documented record of how evidence was collected, handled, transferred, stored and accessed.

Imagine collecting a compromised laptop.

You should document:

1. Who collected it?
2. When was it collected?
3. Where was it collected?
4. What condition was it in?
5. Who handled it afterward?
6. Where was it stored?
7. Were forensic copies created?
8. Were hashes calculated and verified?

Why?

Because evidence may later be reviewed by auditors, investigators, regulators or courts.

What is hashing?

A forensic investigator can calculate a SHA-256 hash of a forensic image.

If the hash remains consistent during verification, that supports the conclusion that the image has not changed.

A hash alone doesn't prove when or how evidence was collected. Proper documentation and handling are also necessary.

Root Cause Analysis

Root Cause Analysis (RCA) means identifying the underlying reason an incident happened.

Example:

A company suffers a ransomware attack.

A weak investigation might conclude:

"An employee opened a malicious attachment."

A proper investigation asks:

• Why did the email reach the employee?
• Why wasn't the attachment blocked?
• Why could the document execute suspicious code?
• Why did the employee account have excessive permissions?
• Why wasn't the endpoint isolated earlier?
• Why were backups accessible to the attacker?

The goal isn't simply to blame someone.

It's to identify the weaknesses that allowed the incident to happen.

Five Whys technique

Imagine ransomware infected a server.

This helps teams identify improvements instead of stopping at the first obvious explanation.

Incident Response Documentation

Every serious incident should be documented.

A useful incident report includes:

A good incident report separates:

• Confirmed facts.
• Suspected activity.
• Unknown information.
• Actions already taken.
• Recommended next actions.

Never present an assumption as a confirmed fact.

Incident Response Roles

A cybersecurity incident is rarely handled by one person.

Different teams have different responsibilities.

As a beginner SOC analyst, your job is generally to detect, investigate, document and escalate according to your organization's procedures.

You aren't expected to independently make every major containment or business decision.

Important Incident Response Frameworks

These are useful names to recognize professionally.

• — Publishes cybersecurity standards and guidance, including incident response guidance.
• — Provides incident handling training and practical guidance.
• — Publishes incident response resources and cybersecurity advisories.
• — Standard for information security management systems.

Useful resources:

• NIST SP 800-61 Rev. 3 — Incident Response Recommendations
• CISA StopRansomware
• SANS Institute

Practical SOC Investigation — Case IR-010

You're working as a SOC analyst for a company operating several airport facilities.

Your security monitoring system generates this alert:

Knowledge check

Analyst assignment

Now imagine your security manager asks:

"Ransomware has infected an employee computer and potentially reached an airport operations file server. What should our response team do?"

Answer these six questions:

1. What makes this a critical incident?
2. Which systems should be investigated?
3. How would you contain the infection without unnecessarily disrupting airport operations?
4. What evidence should be preserved?
5. How would you eradicate the threat and restore operations?
6. What improvements would prevent a repeat attack?

Important: In this scenario, operational safety comes first. Coordinate containment with airport operations and incident leadership rather than independently disconnecting safety-critical systems.

What is Threat Hunting?

Threat hunting is the proactive process of searching through systems, networks and security data to discover threats that automated security tools may have missed.

Think about it this way:

Example

Your EDR hasn't generated any alerts.

However, you notice:

• An employee logs in at 03:15 AM.
• The login originates from an unfamiliar location.
• PowerShell executes shortly afterward.
• A new scheduled task appears.
• The computer communicates with an unfamiliar external domain.

No single event necessarily proves an attack.

But together?

That's something worth investigating.

The Threat Hunting Process

A practical threat hunting workflow has five stages:

One important distinction: a threat hunt doesn't have to discover an attacker to be successful. It can also identify gaps in monitoring and improve security visibility.

Threat Hunting Hypotheses

A hypothesis is an informed assumption that you investigate using evidence.

Here are five examples:

Example: Compromised account

Your hypothesis:

"An attacker may be using a compromised administrator account outside normal working hours."

You investigate:

• Windows Event ID 4624 — successful logon.
• Windows Event ID 4625 — failed logon.
• Windows Event ID 4672 — special privileges assigned.
• VPN authentication records.
• Microsoft Entra ID sign-in logs, if applicable.

You discover an administrator account logged in from an unfamiliar source at 02:40 AM.

Next, you check what happened after authentication.

Did the account access unusual servers? Create users? Execute PowerShell? Access sensitive files?

That's threat hunting.

Understanding Indicators of Compromise (IOCs)

During threat hunting, analysts search for Indicators of Compromise.

An IOC is an observable clue that may indicate a system or account has been compromised.

Common IOCs include:

Important: An IOC is not automatically proof of an attack.

A legitimate application could contact an unfamiliar IP. An attacker could also change their infrastructure, making an old IOC useless.

That's why analysts investigate context and behaviour.

IOC vs IOA

These two terms are easy to confuse.

• IOC — Indicator of Compromise: Evidence that may indicate compromise has occurred.
• IOA — Indicator of Attack: Behaviour suggesting an attack is happening or being attempted.

Example:

• IOC: A known malicious file hash appears on a workstation.
• IOA: Microsoft Word launches PowerShell and downloads an executable.

IOAs can be particularly useful because attackers can change their tools, filenames and IP addresses, but their behaviours may remain similar.

Behavioural Threat Hunting

This is where you start thinking like a real SOC analyst.

Instead of searching only for known malware, you search for suspicious behaviour.

Behaviour 1: Suspicious process execution

Behaviour 2: Persistence

Persistence means an attacker attempts to maintain access to a compromised system.

Common places to investigate:

• Windows scheduled tasks.
• Registry Run keys.
• Windows services.
• Startup folders.
• Unauthorized accounts.
• Suspicious scripts.

Example:

An employee reports that their computer is acting strangely.

You find a scheduled task running an unknown executable every time the computer starts.

You investigate:

1. Who created the task?
2. When was it created?
3. Which executable does it launch?
4. Where is that executable stored?
5. What account runs it?
6. Does the executable communicate externally?

Behaviour 3: Lateral Movement

Lateral movement occurs when an attacker moves from one compromised system to another within an environment.

Example:

1. Attacker compromises an employee workstation.
2. Steals the employee's credentials.
3. Accesses a file server.
4. Attempts to access an administrator workstation.
5. Attempts to reach a Domain Controller.

A threat hunter searches for unusual connections, authentication patterns and privilege usage across multiple machines.

Behaviour 4: Data Exfiltration

Data exfiltration means unauthorized transfer of information out of an environment.

Indicators worth investigating:

• Unusually large outbound transfers.
• Unexpected cloud-storage uploads.
• Unfamiliar external destinations.
• Large transfers outside normal working hours.
• Unusual DNS traffic.
• Access to sensitive files by unexpected accounts.

For example, an employee workstation normally uploads 20 MB per day, but suddenly uploads 8 GB overnight.

That doesn't automatically mean data theft. Backups and legitimate synchronization can explain large transfers. But it deserves investigation.

Threat Hunting Tools

These are tools worth recognizing and eventually learning hands-on.

  SIEM platform for collecting, analysing and correlating security data. Supports KQL queries.
  <text color="secondary" size="xs"><a href="https://learn.microsoft.com/en-us/azure/sentinel/">Microsoft Sentinel documentation</a></text>
</box>

  Searches, analyses and visualizes machine-generated data using SPL.
  <text color="secondary" size="xs"><a href="https://www.splunk.com/">Splunk official website</a></text>
</box>

  Examines network packets to investigate communication between devices.
  <text color="secondary" size="xs"><a href="https://www.wireshark.org/">Wireshark official website</a></text>
</box>

  Provides detailed Windows system activity, including process creation and network connections.
  <text color="secondary" size="xs"><a href="https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon">Sysmon documentation</a></text>
</box>

  Collects endpoint evidence and supports large-scale threat hunting.
  <text color="secondary" size="xs"><a href="https://docs.velociraptor.app/">Velociraptor documentation</a></text>
</box>

Introduction to Threat Hunting Queries

Now let's learn how analysts actually search for suspicious activity.

Two common query languages are:

• KQL: Kusto Query Language, used in Microsoft Sentinel and other Microsoft security products.
• SPL: Search Processing Language, used in Splunk.

Here's a basic KQL example.

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "powershell.exe"
| project Timestamp, DeviceName,
          AccountName, InitiatingProcessFileName,
          ProcessCommandLine
| order by Timestamp desc

What does this do?

This is a starting point, not a complete malicious-activity detector.

Here's another example:

DeviceLogonEvents
| where Timestamp > ago(24h)
| where ActionType == "LogonSuccess"
| project Timestamp, DeviceName,
          AccountName, RemoteIP,
          LogonType
| order by Timestamp desc

This searches successful logons and displays their associated information.

Analyst mindset: A query finds activity. Your investigation determines whether that activity is suspicious.

Baseline Analysis — Knowing What's Normal

One of the most important threat hunting skills is understanding normal behaviour.

This is called baseline analysis.

Suppose an employee normally:

• Logs in between 08:00 and 17:00.
• Uses one company laptop.
• Accesses three internal servers.
• Transfers around 100 MB daily.

Suddenly, the same account:

• Logs in at 03:00.
• Connects from a new IP.
• Accesses 15 servers.
• Transfers 12 GB of data.

That pattern deserves investigation.

But don't jump to conclusions. Maybe the employee was authorized to perform overnight maintenance.

A good analyst compares activity against:

1. The user's normal behaviour.
2. The device's normal behaviour.
3. The organization's normal behaviour.
4. The user's role and permissions.
5. Known maintenance schedules.

The golden rule: Unusual does not automatically mean malicious.

MITRE ATT&CK and Threat Hunting

Remember MITRE ATT&CK from Chapter 6?

It's especially useful for threat hunting because it helps organize attacker behaviour into tactics and techniques.

Some examples:

Official resource: MITRE ATT&CK knowledge base.

When investigating an incident, you can map observed behaviour to ATT&CK techniques.

For example:

• Word opens a malicious attachment.
• PowerShell executes a downloaded payload.
• A scheduled task maintains persistence.
• The attacker accesses another server.
• Data is transferred externally.

This gives your investigation a structured picture of the attack.

Threat Hunting vs Incident Response

These two disciplines work together, but they aren't the same.

A threat hunt can discover an incident, at which point the organization follows its incident response procedures.

Practical Threat Hunting Exercise

Your SIEM provides these events:

Questions for your investigation

1. What is your initial threat hunting hypothesis?
2. Which events are the strongest indicators of suspicious activity?
3. What would you investigate about the administrator account?
4. How would you determine whether the scheduled task is malicious?
5. How would you investigate the outbound data transfer?
6. At what point would you escalate this to incident response?

What evidence would you collect?

• Authentication records.
• Administrator account details and group memberships.
• PowerShell command lines.
• Scheduled task configuration and creation records.
• Destination IP and network logs.
• EDR process tree.
• File and process hashes.
• Relevant timestamps.

Don't immediately delete the scheduled task or terminate processes without following the response procedure and considering evidence preservation.

Knowledge Check

What is Cloud Computing?

Cloud computing means accessing computing resources over a network, usually the internet, instead of relying entirely on hardware owned and operated locally.

Instead of buying a physical server, a company can rent computing resources from a cloud provider.

For example, a company might use cloud services to:

• Store employee records.
• Host its website.
• Run business applications.
• Store customer databases.
• Manage employee accounts.
• Back up company information.
• Run security monitoring systems.

Major cloud providers

  Offers services such as EC2, S3, IAM and CloudTrail.

  <text color="secondary" size="xs"><a href="https://aws.amazon.com/">Official website</a></text>
</box>

  Offers Virtual Machines, Entra ID, Storage and Microsoft Defender for Cloud.

  <text color="secondary" size="xs"><a href="https://azure.microsoft.com/">Official website</a></text>
</box>

  Offers Compute Engine, Cloud Storage, IAM and Cloud Logging.

  <text color="secondary" size="xs"><a href="https://cloud.google.com/">Official website</a></text>
</box>

The Three Cloud Service Models

You need to understand these three terms because they appear frequently in cybersecurity job descriptions.

Quick comparison

The more managed the service, the more responsibility the provider takes on — but the customer never gets to ignore security.

Shared Responsibility Model

This is one of the most important concepts in cloud security.

Shared Responsibility Model means the cloud provider and the customer share security responsibilities.

Imagine a company stores employee salary information in AWS.

AWS protects the underlying physical infrastructure, but the company must properly configure access to its data.

Responsibilities vary by service and provider.

Example

A company accidentally makes an S3 storage bucket publicly accessible.

An attacker downloads confidential employee records.

Who is responsible for the misconfiguration?

Generally, the customer.

The cloud provider supplies the service, but the customer must configure it securely.

Essential Cloud Security Terminology

Let's build your cloud security vocabulary.

Cloud IAM — Identity and Access Management

Remember Chapter 8, where we studied Active Directory, Kerberos, permissions and privileged accounts?

Cloud IAM applies similar security principles to cloud resources.

For example, imagine a company has:

• 10 HR employees.
• 5 finance employees.
• 3 IT administrators.
• 1 security analyst.

Should every employee have access to every cloud resource?

Absolutely not.

You apply Least Privilege.

Each person receives only the permissions necessary to perform their job.

Important IAM concepts

1. User: An identity representing a person or service.

2. Role: A collection of permissions that can be assigned or assumed.

3. Policy: A set of rules defining what actions are allowed or denied.

4. Service account / workload identity: An identity used by applications and automated services.

5. MFA: An additional authentication factor beyond a password.

Example: Dangerous permissions

An ordinary employee account has permission to:

• Read employee records.
• Delete cloud backups.
• Create administrator accounts.
• Modify security settings.

That's excessive privilege.

A security analyst should investigate why those permissions exist and whether they have been abused.

Cloud Security Threats and Attacks

Cloud environments introduce security risks that SOC analysts must recognize.

  A storage bucket or container is accidentally made accessible to everyone.

  Risk: Confidential files become publicly accessible.
</box>

  API keys, passwords or access tokens are leaked through code repositories, configuration files or phishing.

  Risk: Attackers use those credentials to access cloud resources.
</box>

  An attacker compromises a cloud administrator account.

  Risk: They may create users, change permissions, access data or disable security controls.
</box>

  Attackers abuse cloud computing resources to mine cryptocurrency.

  Risk: High computing costs, degraded performance and compromised workloads.
</box>

  Attackers compromise cloud accounts, workloads or storage and encrypt or destroy accessible data.

  Risk: Data loss, business disruption and potentially expensive recovery.
</box>

  Insecure firewall rules, excessive permissions, exposed services or disabled logging.

  Risk: Attackers find weaknesses without necessarily exploiting a software vulnerability.
</box>

A particularly important attack: Stolen cloud credentials

Imagine an attacker obtains an employee's cloud access key.

They might:

1. Authenticate using the stolen key.
2. Enumerate cloud resources.
3. Discover storage buckets.
4. Access confidential files.
5. Create additional credentials.
6. Establish persistent access.
7. Exfiltrate data.

Notice something?

The attacker might not need malware at all.

They can abuse legitimate cloud services using stolen credentials.

That's why cloud identity monitoring is extremely important.

Cloud Logging and Monitoring

This is where cloud security connects directly to your SOC analyst training.

A SOC analyst needs visibility into what users, applications and services are doing in the cloud.

Important cloud logging services

For example, AWS CloudTrail can record actions such as:

• Someone creating an IAM user.
• Someone changing permissions.
• Someone accessing an S3 bucket.
• Someone disabling a logging service.
• Someone creating a new access key.

Example investigation

Your SIEM receives this fictional sequence:

A SOC analyst should investigate the account, source IP, authentication method, API actions, accessed resources and data transfer.

The logging configuration change is particularly concerning because an attacker may be trying to reduce visibility.

Cloud Security Monitoring Tools

These are important products and technologies to recognize.

  Helps identify cloud security weaknesses, threats and workload risks.

  <text size="xs" color="secondary"><a href="https://learn.microsoft.com/en-us/azure/defender-for-cloud/">Documentation</a></text>
</box>

  Detects suspicious activity and potential threats in AWS environments.

  <text size="xs" color="secondary"><a href="https://aws.amazon.com/guardduty/">Official website</a></text>
</box>

  Helps discover vulnerabilities, misconfigurations and threats in Google Cloud.

  <text size="xs" color="secondary"><a href="https://cloud.google.com/security-command-center">Official website</a></text>
</box>

  Provides cloud security visibility, risk prioritization and exposure analysis.

  <text size="xs" color="secondary"><a href="https://www.wiz.io/">Official website</a></text>
</box>

Three cloud security terms you'll encounter in job descriptions

You don't need to memorize every vendor's product today. Understand what problem each technology solves.

Containers and Kubernetes Security

Modern applications are often deployed using containers.

What is a container?

A container packages an application and its dependencies so it can run consistently across environments.

Docker is a popular container platform.

What is Kubernetes?

Kubernetes is a platform used to deploy, manage and scale containerized applications.

Important terminology

Security risks

• Vulnerable container images.
• Exposed management interfaces.
• Stolen Kubernetes credentials.
• Excessive container permissions.
• Insecure secrets.
• Compromised container registries.

Example

A company deploys an application using a vulnerable container image.

An attacker exploits the vulnerable application and gains access to the container.

The attacker then attempts to access sensitive credentials stored in the environment.

A SOC analyst investigates:

1. Which container was compromised?
2. Which image was used?
3. What process executed?
4. Did the attacker access secrets?
5. Did the attacker interact with the Kubernetes API?
6. Were other containers or nodes affected?

Cloud Threat Hunting — Practical KQL

Let's connect this to Chapter 11.

Microsoft Sentinel uses KQL to query security data.

Here's a fictional example using Azure Activity Logs:

AzureActivity
| where TimeGenerated > ago(24h)
| where OperationNameValue contains "Microsoft.Authorization"
| project TimeGenerated,
          Caller,
          CallerIpAddress,
          OperationNameValue,
          ActivityStatusValue
| order by TimeGenerated desc

What does this investigate?

It searches Azure activity records for operations involving authorization resources, which may include changes to access permissions.

Another example:

SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType != "0"
| project TimeGenerated,
          UserPrincipalName,
          IPAddress,
          Location,
          ResultDescription
| order by TimeGenerated desc

This searches for unsuccessful sign-in events.

These queries are starting points. Table availability, field names and permissions depend on your Microsoft Sentinel data configuration.

Cloud Security Defenses

Now let's look at how organizations protect their cloud environments.

Five controls I'd prioritize

1. Require MFA for privileged accounts.
2. Prevent public access to sensitive storage.
3. Remove unused credentials and access keys.
4. Enable and protect audit logging.
5. Maintain tested, protected backups.

For critical environments, also monitor changes to security policies, administrator roles and logging configurations.

Practical SOC Case Study — CLOUD-012

Your investigation questions

1. What is the likely initial compromise?
2. Why is creating a new access key suspicious?
3. What evidence would confirm whether the attacker accessed confidential information?
4. Why might changing CloudTrail logging be dangerous?
5. How would you contain the compromised identity?
6. How would you determine whether the attacker accessed other cloud resources?

Expected response priorities

• Preserve relevant logs and evidence.
• Identify the compromised identity and its permissions.
• Revoke or disable compromised credentials through approved procedures.
• Review active sessions and other credentials.
• Investigate storage access and possible data exfiltration.
• Check for additional users, roles and permission changes.
• Restore secure logging and verify monitoring.
• Escalate to incident response and the appropriate cloud administrators.

Don't just delete the compromised account. You need to understand what the attacker created, changed and accessed before and during containment.

Chapter 12 Examination

What does a SOC analyst actually do?

A Security Operations Center (SOC) analyst monitors an organization's digital environment for suspicious activity, investigates security alerts and responds according to established procedures.

A typical shift might look like this:

SOC Tier 1 vs Tier 2 vs Tier 3

Job titles and responsibilities vary by organization. Some smaller SOCs combine several levels.

Your investigation toolkit

Before investigating, understand what information each tool provides.

These tools are complementary. No single tool tells you the entire story.

The SOC investigation methodology

When an alert arrives, follow a consistent workflow.

Two concepts you must separate

Severity: How damaging could the incident be?

Confidence: How certain are you that the activity is malicious?

For example:

• High severity, low confidence: A possible ransomware alert on a critical server.
• High severity, high confidence: Confirmed ransomware encrypting a critical server.
• Low severity, high confidence: Confirmed unwanted software on a non-critical workstation.

This distinction helps analysts prioritize correctly.

Practical Investigation 1 — Brute Force Attack

Affected account: finance.user

Source IP: 203.0.113.45

Target: FINANCE-PC-04

Step 1: Understand the alert

Five failed logins followed by a successful login.

Possible explanations:

• Employee repeatedly entered the wrong password.
• An application used an outdated password.
• An attacker attempted password guessing.
• An attacker successfully guessed or obtained the password.

Step 2: Investigate the account

You should examine:

• Whether the login originated from a familiar location.
• Whether the source IP is associated with the employee.
• Whether MFA was used.
• Whether the login time is unusual.
• Whether other accounts were targeted.
• What happened after successful authentication.

Step 3: Examine Windows Event IDs

Step 4: Build your conclusion

A successful login after repeated failures is suspicious, but it doesn't prove an account compromise.

You need additional evidence.

If the login is unauthorized, escalate according to incident procedures and consider account containment, session revocation and credential resets.

Analyst finding: Suspicious authentication activity requiring further investigation.

Practical Investigation 2 — Malware Execution

<box background="surface" padding={2} radius="md" align="center">
  `explorer.exe`
  <caption>Windows desktop process</caption>
</box>
<box align="center"><icon name="arrow-down"/></box>
<box background="surface" padding={2} radius="md" align="center">
  `WINWORD.EXE`
  <caption>Microsoft Word</caption>
</box>
<box align="center"><icon name="arrow-down" color="danger"/></box>
<box background="rgba(190,60,60,0.12)" padding={2} radius="md" align="center">
  `powershell.exe`
  <span class="ce-badge ce-badge-error">Suspicious</span>
</box>
<box align="center"><icon name="arrow-down" color="danger"/></box>
<box background="rgba(190,60,60,0.12)" padding={2} radius="md" align="center">
  `invoice_update.exe`
  <span class="ce-badge ce-badge-error">Unknown executable</span>
</box>

Step 1: Identify the suspicious behaviour

Word launching PowerShell is unusual in many office environments.

PowerShell launching an unfamiliar executable increases concern.

A scheduled task may indicate persistence.

Step 2: Collect evidence

Step 3: Map the behaviour to MITRE ATT&CK

Reference: MITRE ATT&CK.

Step 4: Decide what to do

A reasonable response would be:

1. Preserve relevant EDR and system evidence.
2. Determine whether the executable is malicious.
3. Investigate other devices for the same indicators.
4. Coordinate endpoint isolation if compromise is confirmed or sufficiently suspected.
5. Investigate potential credential theft and data exfiltration.
6. Escalate to incident response.

Analyst finding: Strong indicators of malware execution and possible persistence.

Practical Investigation 3 — Network Traffic Analysis

Now let's investigate network activity.

Your SIEM generates an alert:

What should you investigate?

1. Destination IP

Research whether the destination is known, expected or associated with suspicious activity.

2. Port and protocol

TCP 443 commonly carries HTTPS traffic.

But encrypted traffic isn't automatically safe.

3. Transfer volume

Why did a workstation transfer 4.8 GB overnight?

4. Device owner

Was an employee performing an authorized backup or file transfer?

5. Application and process

Which process initiated the connection?

6. Data sensitivity

Did the workstation have access to confidential company information?

Wireshark example

Wireshark lets you inspect network packets.

Useful display filters:

ip.addr == 192.168.10.45

Shows packets involving the specified IP.

tcp.port == 443

Shows TCP traffic using port 443.

dns

Shows DNS packets.

http.request

Shows HTTP requests when visible in the capture.

For HTTPS, packet contents are normally encrypted, so you may need endpoint telemetry, DNS records, TLS metadata and proxy logs to understand the connection.

Analyst finding: Unusual outbound transfer requiring investigation for possible data exfiltration.

Practical Investigation 4 — Privilege Escalation

Your investigation

You need to determine:

• Who created the account?
• Who added it to the privileged group?
• Was the change approved?
• What permissions were granted?
• What did the account access afterward?
• Were other systems affected?
• Was sensitive information accessed?

Don't assume every new administrator account is malicious. Approved IT maintenance can create legitimate changes.

Analyst finding: Potential unauthorized privilege escalation and account abuse.

Build an Investigation Timeline

This is one of the most valuable skills a SOC analyst can develop.

Imagine the four cases are related to the same attacker.

You discover the following combined timeline:

This is why correlation matters.

An individual event might look harmless.

But multiple related events can reveal an attack.

Your job is to connect the evidence, establish what happened and determine the impact.

Hands-on SOC Commands

Windows PowerShell

These are useful defensive investigation commands.

Example:

Get-FileHash "C:\Temp\invoice.exe" -Algorithm SHA256

This calculates the SHA-256 hash of a file.

Another example:

Get-NetTCPConnection |
Select-Object LocalAddress, LocalPort,
RemoteAddress, RemotePort, State

This displays network connections on a Windows machine.

Linux investigation commands

These are useful starting points, not substitutes for a complete investigation.

Your Final SOC Analyst Challenge

You're now the Tier 1 SOC analyst at a fictional company called Maldives Aviation Services.

Your SIEM generates this alert:

Your assignment

Answer these questions as if you're reporting to your SOC manager.

1. What is your initial assessment?
2. Which three events concern you the most, and why?
3. What evidence would you collect?
4. How would you establish the attack timeline?
5. How would you investigate whether data was stolen?
6. What containment measures would you recommend?
7. What is your incident severity and confidence?
8. Write a short incident report for your manager.

Final examination

Understand the job you're applying for

A SOC Analyst (Security Operations Center Analyst) monitors an organization's systems and investigates potential security threats.

Typical responsibilities include:

• Monitoring SIEM alerts.
• Investigating suspicious logins.
• Reviewing Windows and Linux logs.
• Analysing suspicious processes.
• Investigating malware alerts.
• Identifying indicators of compromise.
• Monitoring network traffic.
• Documenting incidents.
• Escalating confirmed threats.

SOC Analyst Tier 1 — What employers expect

You don't need to be an expert in every area for an entry-level position. You do need to demonstrate sound fundamentals and a willingness to learn.

The most common SOC interview questions

These are questions you should be able to answer without reading from a screen.

Question 1: What is cybersecurity?

Strong answer:

"Cybersecurity is the practice of protecting systems, networks, applications and data from unauthorized access, attacks, damage and disruption."

Question 2: Explain the CIA Triad.

Strong answer:

"The CIA Triad consists of Confidentiality, Integrity and Availability. Confidentiality ensures information is only accessible to authorized users. Integrity ensures information remains accurate and unaltered. Availability ensures systems and information remain accessible when needed."

Question 3: What is the difference between a threat and a vulnerability?

Strong answer:

"A threat is something capable of causing harm, while a vulnerability is a weakness that could be exploited by a threat."

Example:

• Threat: A cybercriminal.
• Vulnerability: An unpatched server.
• Exploit: A method used to abuse that weakness.
• Risk: The potential damage resulting from exploitation.

Question 4: What is a SIEM?

Strong answer:

"A Security Information and Event Management system collects and analyses logs from multiple sources, correlates events and generates alerts to help security analysts detect and investigate suspicious activity."

Examples: Microsoft Sentinel and Splunk.

Question 5: What is the difference between IDS and IPS?

Strong answer:

"An Intrusion Detection System monitors network activity and identifies potential threats. An Intrusion Prevention System can also actively block or prevent detected malicious traffic."

Question 6: What is the difference between authentication and authorization?

Strong answer:

"Authentication verifies who a user is. Authorization determines what that authenticated user is allowed to access or do."

Question 7: What is phishing?

Strong answer:

"Phishing is a social engineering attack in which an attacker impersonates a trusted person or organization to trick someone into revealing sensitive information, opening malicious attachments or visiting malicious websites."

Question 8: What is an IOC?

Strong answer:

"An Indicator of Compromise is an observable artifact that may indicate a system or account has been compromised. Examples include malicious file hashes, suspicious IP addresses, malicious domains and unauthorized accounts."

Question 9: What is EDR?

Strong answer:

"Endpoint Detection and Response monitors endpoint activity, detects suspicious behaviour and provides investigation and response capabilities. It helps analysts investigate process execution, file activity, network connections and potential malware."

Question 10: What is incident response?

Strong answer:

"Incident response is the structured process of identifying, investigating, containing, eradicating and recovering from cybersecurity incidents, followed by reviewing lessons learned."

Technical questions that separate candidates

These questions test whether you understand what happens during an actual investigation.

Question 11: What would you do if you noticed 50 failed login attempts followed by one successful login?

Strong answer:

"I would treat it as suspicious authentication activity. I would identify the affected account, source IP, timestamps and login locations. I would examine whether MFA was used and review activity following the successful login. I would check for privilege changes, unusual resource access and lateral movement. If compromise is suspected, I would preserve evidence and escalate according to incident response procedures."

Question 12: What is Event ID 4624?

A successful Windows logon.

Other important Event IDs:

Question 13: What would you do if Microsoft Word launched PowerShell unexpectedly?

Strong answer:

"I would investigate the parent-child process relationship, PowerShell command line, file hashes, file locations and any network connections. I would examine EDR telemetry and determine whether a malicious document or script was involved. If malicious execution is confirmed or strongly suspected, I would follow the organization's containment and escalation procedures."

Question 14: What is lateral movement?

"Lateral movement is when an attacker moves from one compromised system to another within an organization's environment, often to access additional resources or gain greater control."

Question 15: What is the difference between a false positive and a false negative?

• False positive: A security system flags legitimate activity as malicious.
• False negative: Malicious activity occurs but the detection system fails to identify it.

Question 16: What is the difference between hashing and encryption?

Question 17: What is the difference between TCP and UDP?

"TCP is connection-oriented and provides reliable, ordered delivery. UDP is connectionless and does not guarantee delivery or ordering, but has lower protocol overhead."

Question 18: What would you do if an EDR detected ransomware?

Strong answer:

"I would validate the alert, identify the affected endpoint and examine process activity, file modifications and network connections. I would assess whether the ransomware is spreading and coordinate isolation with the incident response team. I would preserve evidence, investigate other affected systems and support eradication and recovery."

Question 19: What is MITRE ATT&CK?

"MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on observed attacker behaviour. Security analysts use it to understand attacks, map investigation findings and improve detection coverage."

Question 20: What is the difference between vulnerability scanning and penetration testing?

• Vulnerability scanning identifies known weaknesses.
• Penetration testing attempts to exploit weaknesses within an authorized scope to evaluate real-world security impact.

HR and behavioural interview questions

Technical knowledge isn't everything. Employers also want someone who can communicate, work under pressure and follow procedures.

This is where your aviation operations and safety background can become an advantage.

Question 21: Tell me about yourself.

Here's a possible answer based on your career background:

" I have experience in airport operations and safety, where attention to detail, following procedures, risk awareness and communication are extremely important. My interest in technology and cybersecurity has led me to develop knowledge in networking, Windows security, SIEM, incident response and threat detection. I'm now looking to build a career in cybersecurity, particularly in security operations, where I can combine my operational experience with my technical knowledge."

Don't memorize it word for word. Make it sound like you.

Question 22: Why do you want to become a SOC analyst?

"I enjoy investigating problems, identifying unusual activity and understanding how systems work. Cybersecurity combines technical analysis, critical thinking and risk management. I'm particularly interested in threat detection and incident response because I want to help organizations identify and respond to security threats before they cause significant damage."

Question 23: You don't have professional cybersecurity experience. Why should we hire you?

"Although I'm still developing my professional cybersecurity experience, I've built a foundation in networking, Windows security, SIEM concepts, incident response and cloud security. My previous operational experience has also taught me to follow procedures, remain attentive, communicate clearly and take risks seriously. I'm willing to learn, accept feedback and develop my technical skills."

Question 24: How do you handle pressure?

"In operational environments, I've learned that pressure requires clear communication, prioritization and following established procedures. I avoid making assumptions, assess the situation and focus on the most important risks first."

Question 25: What would you do if you didn't know how to investigate an alert?

"I would first review the alert details and available documentation, then consult relevant procedures and trusted technical resources. If I still couldn't determine the correct response, I would escalate to a senior analyst rather than take an action that could compromise evidence or disrupt business operations."

That's a good answer. Pretending to know everything is a terrible strategy.

How to turn your aviation experience into a cybersecurity advantage

This is worth understanding before you attend interviews.

Your previous work wasn't cybersecurity, but several skills transfer directly.

For example:

An Airport Safety Officer identifies a potential operational hazard, evaluates the risk, follows procedures and reports the findings.

A SOC analyst identifies suspicious activity, evaluates the security risk, follows procedures and reports the findings.

The technical subject is different, but the discipline of investigation and risk management transfers well.

How to answer scenario-based questions

Interviewers often give you a situation and ask what you would do.

Use this five-step structure:

Use this structure when you're stuck. It keeps your answer organized and demonstrates an analyst mindset.

Certifications and practical skills employers recognize

A certificate can help demonstrate learning, but employers also want proof that you can actually investigate security events.

Some useful options:

  Good for networking and cybersecurity fundamentals.

  <a href="https://www.netacad.com/">Cisco Networking Academy</a>
</box>

  Broad security knowledge, threats, architecture, identity and risk management.

  <a href="https://www.comptia.org/certifications/security">Official certification</a>
</box>

  Focuses on security operations, threat detection, incident response and Microsoft security tools.

  <a href="https://learn.microsoft.com/en-us/credentials/certifications/security-operations-analyst/">Official certification</a>
</box>

  Hands-on labs for networking, defensive security, Windows, Linux and SOC investigations.

  <a href="https://tryhackme.com/">Official website</a>
</box>

My suggested learning order:

1. Finish the Cisco cybersecurity fundamentals training.
2. Practise hands-on SOC investigations.
3. Build familiarity with Microsoft Sentinel and KQL.
4. Work toward Security+ if it fits your budget and career plan.
5. Consider SC-200 when you've developed more practical experience.

You don't need to collect ten certificates before applying for an entry-level role.

Build a small SOC portfolio

This is how you demonstrate that you've done more than watch lessons.

Create a small portfolio containing:

For each project, include:

• Objective.
• Tools used.
• Evidence collected.
• Investigation steps.
• Findings.
• Conclusion.
• Recommended response.

Use synthetic data or authorized lab environments. Never publish real company logs, employee details, credentials or confidential information.

Final SOC Analyst Mock Interview

This is your final practical assessment.

Your answer sheet