SOC Operations: From Alert to After-Action
A free online course in how a security operations center actually works: an alert arrives, someone decides whether it matters, the investigation finds out how far it went, the team contains it, and someone writes it up so it doesn’t happen again. Six weeks, twelve lessons, and one intrusion you work from the first alert to the after-action review.
Who it’s for: people starting out in a SOC or heading for one, IT folks moving into security, and analysts who know one corner of the job and want to see all of it. You should be comfortable with Windows and a spreadsheet. You don’t need to program.
What you need: a computer with a modern browser. The exercises use the jon.glass tools, which run entirely in the browser, and Case 01, a fictional intrusion with realistic evidence.
How It Works
Every lesson has the same four parts:
- Learn: the ideas, and why they matter on shift.
- Read: a post that goes deeper on the tool or the idea.
- Do: an exercise in one of the tools, on the course’s case.
- Hand in: something that goes into your case file in Tessera.
One case, all course long. Case 01 starts with a phishing email and ends with a file server uploading the finance share while the SOC isolates the wrong machine. Each week works the next part of it, so by week 6 you’ve investigated a whole intrusion, and your Tessera case file holds the findings, timeline, indicators, scope, evidence and decisions to prove it. Then the capstone gives you a new case to work on your own.
Your case file is your work. It stays in your browser. Export it from Tessera to keep it, to come back to it on another machine, or to hand it to an instructor or a study group.
This course is being written. Every exercise below works today; the lesson notes are published as they're ready.
The Schedule
| Week | Theme | Lessons |
|---|---|---|
| 1 | The SOC and the alert | 1. What a SOC does, 2. Alert triage |
| 2 | Logs and timelines | 3. Windows event logs for analysts, 4. Building a timeline |
| 3 | Network and identity | 5. Network evidence, 6. Identity and lateral movement |
| 4 | Files and indicators | 7. File triage, 8. Indicators and detection |
| 5 | Containment and response | 9. Containment decisions, 10. Playbooks |
| 6 | Communicate and improve | 11. Reporting and the record, 12. The after-action review |
Week 1: The SOC and the alert
1What a SOC does
LearnThe incident lifecycle (prepare, detect and analyze, contain and eradicate, recover, learn), how tiers and queues turn alerts into cases, severity, and why the case record matters more than any tool.
ReadKeeping the Whole Case in One Place
DoOpen Case 01 in Tessera. Read the Case 01 briefing, then look at what the case file already holds at 16:20: three events, two hosts in scope, one indicator, and the decisions made before you were called.
Hand inA first summary in Tessera: what you think happened, in three sentences, and the three questions you have to answer.
2Alert triage
LearnTrue positive, false positive and benign; what context an alert needs before you close it; when to escalate; and what an alert closed too early costs.
DoCase 01's EDR alerts in Mill. Work the seven alerts in the queue as if they had just arrived. For each: true or false positive, how sure you are, and what you would check next. Then compare with what the SOC actually did.
Hand inA finding in Tessera for each alert that deserved escalation, with your confidence.
Week 2: Logs and timelines
3Windows event logs for analysts
LearnThe events that carry most investigations: logons and their types (4624, 4648, 4672), process starts (4688, Sysmon 1), scheduled tasks and services (4698, 7045), network and DNS (Sysmon 3, 22), file activity (Sysmon 11, 23), and the log being cleared (1102). Reading EvtxECmd's CSV.
ReadLearning pandas One Block at a Time
DoWKS-01's key events in Shifu. Step through the recipe's blocks and see what each one removes. Find what the attachment ran, how the attacker survives a reboot, and what they ran to learn about the network.
Hand inFindings in Tessera for execution, persistence and discovery, each citing its event IDs.
4Building a timeline
LearnWhy everything goes on one clock (UTC), merging sources with different timestamp formats, pivoting around a single event, and tagging the moments that tell the story.
DoCase 01's logs in Mill. Merge the email, proxy and EDR logs, add WKS-01's events from Shifu, and zoom into the 13:09 burst. Tag the phish, the execution and the persistence.
Hand inSend the tagged events to Tessera's timeline.
Week 3: Network and identity
5Network evidence
LearnProxy and DNS logs, what beaconing looks like (an interval, and jitter around it), spotting data leaving by volume and destination, and staging and exfiltration tools.
DoCase 01's proxy log in Mill. Find the command-and-control address and measure the beacon interval with the Δ column. Find the upload, its size and its destination. Then find out what was still beaconing after 16:05.
Hand inThe C2 and exfiltration indicators in Tessera, and a timeline event for the upload.
6Identity and lateral movement
LearnHow stolen credentials move an attacker: dumping LSASS, service accounts that work everywhere, explicit-credential logons and remotely created services. Scoping by host, account and data.
ReadSpoke: Seeing the Relationships in Your CSVs
DoCase 01's attack path in Spoke. Follow the path from the phish to the file server. Then build WKS-01's process tree from the raw log in Shifu and find the branch that doesn't belong. FILE-01's Security log was cleared: find the lateral movement in the logs that weren't.
Hand inEvery host, account and dataset in Tessera's scope, each with a status.
Week 4: Files and indicators
7File triage
LearnHashes as identity, identifying a file by its magic bytes, strings in ASCII and UTF-16, the PE header's build time, and what entropy says about packing and encryption.
ReadA Hex Viewer That Knows It's Holding Evidence
DoThe Case 01 implant in Hexes. Prove the file is the one in the logs, under both of its names. Read its build time. Find what its strings give away without decoding anything.
Hand inThe file as evidence in Tessera (Hexes' Add to case), with findings from its strings.
8Indicators and detection
LearnAtomic indicators against behaviors (the pyramid of pain), undoing simple obfuscation (Base64, XOR), files hidden inside files, writing a YARA rule, and sharing indicators safely (defanged).
ReadA Hex Viewer That Knows It's Holding Evidence
DoThe Case 01 implant in Hexes. Decode the XOR-ed configuration, bookmark the kill date, carve out the embedded archive, and write a YARA rule that would find this implant on another machine. Paste the EDR alerts into Tessera's Indicators section and see what comes out.
Hand inA tested YARA rule, and the case's indicators exported from Tessera, defanged.
Week 5: Containment and response
9Containment decisions
LearnIsolate, block, disable or watch: what each one stops and what it doesn't. Why you scope before you contain, how to make the case to the business, and why "we isolated the box" isn't containment.
ReadKnowing When You've Actually Contained an Intrusion
DoThe Kestrel case in Scrimmage. Replay the SOC's response and read Scrimmage's verdict. Reset, and find a defender sequence that actually contains the intrusion.
Hand inYour containment plan as decisions in Tessera, with a note thread on the finance decision.
10Playbooks
LearnWriting playbooks before the incident and following them during it, decision points, collecting evidence before cleaning up, and keeping a playbook short enough to use at 3 a.m.
ReadBuilding DFIR Playbooks with Huddle
DoHuddle's Malware on Endpoint playbook. Adapt the playbook for a phishing-led intrusion like Case 01, then run it as a checklist against what you know of the case. Where did the SOC leave the playbook, and what did that cost?
Hand inYour playbook, exported from Huddle.
Week 6: Communicate and improve
11Reporting and the record
LearnFindings with confidence, writing for executives and for engineers, sharing indicators, decision logs, and the chain of custody for evidence you touched.
ReadKeeping the Whole Case in One Place
DoYour Case 01 file in Tessera. Finish the case: the summary, the status of everything in scope, the findings and the decisions. Read the report Tessera builds as someone who wasn't there would.
Hand inThe Case 01 report and case file.
12The after-action review
LearnRunning a blameless review, timelines of detection and response (dwell time, time to detect, time to contain), and turning lessons into changes that stick.
ReadBuilding DFIR Playbooks with Huddle
DoThe Kestrel tabletop in Huddle. Run the Kestrel tabletop with a group, or on your own against the clock. Work out how long the attacker was inside before anyone noticed, and the three changes that would have caught them sooner. Then take on the capstone: a new case, worked on your own from first alert to report.
Hand inThe after-action review, and the capstone case file and report. The capstone case (Case 02) is being built; until it's ready, Case 01 is the capstone.
Related Courses
Agentic SOC Operations (planned) is a separate course on running security operations with AI agents in the loop. Each course stands on its own; take them in either order, or just one.
Going deeper on Windows forensics? The Advanced DFIR Wizard Master Class covers remote acquisition, the files of forensic interest and evidence of execution in depth.