🛡️SOC Level 1

SOC Level 1 — Learn the skills to work as a junior security analyst in a 24/7 SOC team. Monitor alerts, investigate incidents, and protect the organisation.

Completed Rooms

Room	Category	Status	Points	Write-up
Junior Security Analyst Intro	SOC / Blue Team	✅ Completed	—	✅
SOC Role & Blue Team	SOC / Blue Team	✅ Completed	64	✅
Humans as Attack Vectors	SOC / Blue Team	✅ Completed	80	✅
Systems as Attack Vectors	SOC / Blue Team	✅ Completed	—	✅
SOC L1 Alert Triage	SOC / Blue Team	✅ Completed	80	✅

Room Write-ups

Junior Security Analyst Intro

SOC Role & Blue Team

Humans as Attack Vectors

Systems as Attack Vectors

SOC L1 Alert Triage

🔖 Key Concepts

Human element: Humans are the weakest link. Phishing, impersonation, deepfakes, and malware downloads all exploit human psychology via social engineering.
System attacks: Vulnerabilities (CVEs) and misconfigurations are two distinct attack vectors. CVEs are fixed with patches; misconfigurations are fixed with correct setup.
SOC triage: High severity first, then Medium ordered by time. Look for alert clusters before investigating individual alerts.
True Positive rule: A TP requires at least one confirmed indicator of malice — blacklist hit, typosquatted domain, firewall block, or threat intel flag. Suspicion alone is a False Positive.
Escalation triggers: Confirmed user click, multi-user campaign, credential theft risk, executive target, or prior data exfiltration all exceed L1 scope.