SOC Analyst Fundamentals: SIEM Engineering, Incident Triage, and Threat Detection
A practical guide to working in a Security Operations Center, correlating system logs, and mapping threats to the MITRE ATT&CK framework.
1. The Life of a SOC Analyst
Tier 1 Analysts monitor SIEM dashboards, perform initial alert triage, validate true positives versus benign activity, and escalate confirmed incidents.
Tier 2 Incident Responders perform deep forensic analysis, isolate affected systems, and extract Indicators of Compromise (IOCs).
Tier 3 Threat Hunters proactively search for undetected adversaries lurking inside corporate infrastructure.
2. The Indispensable Value of Sysmon Logs
Default Windows security event logs rarely capture sophisticated attack activity. Microsoft System Monitor (Sysmon) provides deep visibility into process creation, network connections, and memory injection.
Event ID 1 (Process Creation): Records parent-child process relationships (e.g., `winword.exe` spawning `powershell.exe`—a hallmark sign of malicious macros).
Event ID 3 (Network Connection): Detects processes initiating external network sockets to unknown IP addresses.
3. Writing High-Fidelity Detection Rules
Modern SIEMs (like Splunk, Elastic, Sentinel) rely on detection logic to spot anomalies. Good rules minimize false positives by checking command-line flags and parent process binaries.
-- Example Elastic EQL Detection Rule for Suspicious PowerShell Execution
process where event.type == "start" and
process.name == "powershell.exe" and
process.args in ("-enc", "-encodedcommand", "-w hidden", "downloadstring") and
not process.parent.name in ("deploy_agent.exe", "backup_service.exe")4. MITRE ATT&CK Mapping
Every alert should map to a specific MITRE ATT&CK technique (e.g., T1059.001 - Command and Scripting Interpreter: PowerShell). This ensures your defensive coverage has measurable metrics across the entire cyber kill chain.