Lab: Be the SOC Analyst

Every other lab in this course takes the attacker’s view. This one flips it: you are the defender in a Security Operations Center, staring at a stream of events, trying to tell the one real attack from the thousands of harmless ones. No install — it runs in your browser.

The exercise

You’re handed one hour of events from a fictional company. Most are noise — backups, normal logins, a printer going offline. Hidden inside is a single intrusion: a chain of events that only looks like an attack when you read them together. Select the ones you think are part of it, then submit.

Why this is hard — and why it matters

No single line screams “attack.” A failed login, a group change, a file export — each is normal on its own. Only correlated do they form the classic kill chain:

foothold → persistence → privilege escalation → collection → exfiltration

Now scale it up. A real mid-market team faces 4,000+ alerts a day. In the 2013 Target breach the tools did fire alerts about the intrusion — they were simply lost in the noise and never acted on, and 40 million cards were stolen. Detection without timely triage is indistinguishable from no detection at all.

How defenders cope

A SIEM aggregates and correlates these scattered logs so the chain becomes visible as one story rather than sixteen unrelated lines.
An autonomous SOC agent now does this triage in seconds — connecting the brute force, the impossible-travel login, the MFA removal, and the data export, then containing the account before a human has read the first alert.
The human moves on the loop: supervising, judging, and handling the cases the machine flags as uncertain.

Debrief

Did you catch the whole chain, or chase a false alarm (the help-desk password reset is a classic decoy)?
How long did it take you for sixteen events? Now imagine four thousand. That gap is the argument for the autonomous SOC.
Which event, missed, would have hurt most? (The exfiltration — once data leaves, the breach is real.)