SOC › Module 2 › Lesson 2
Roles and Tiers
Roles and tiers literacy names L1/L2/L3, IR, and threat-hunt duties — map escalation paths on YOUR $SOC_LAB handoff notes.
Visual · t29_roles_tiers
Tier literacy. $SOC_LAB only. Original Cyberlium.
Opening
L1 triages, L2 deep-dives, L3 hunts — literacy names who does what before you escalate a lab alert wrong.
Tier 1 analysts monitor queues, perform initial triage, and document findings. Tier 2 investigates complex alerts, tunes rules, and correlates across sources. Tier 3 and threat hunt teams pursue hypotheses and advanced adversary behavior. Incident response may spin up separately for active breaches. Cyberlium practices tier vocabulary on YOUR $SOC_LAB escalation card — fictional names and sample alert IDs only. Next: Tools Overview.
1. Tier duties (named)
L1: acknowledge alert, gather basic context, false-positive check, ticket notes, escalate with evidence. L2: deeper log search, rule tuning feedback, malware sandbox requests. L3/hunt: proactive campaigns, adversary emulation awareness — literacy only on Cyberlium.
On $SOC_LAB, label which tier owns each step for one sample brute-force alert.
Command guide
Try these commands — Tier duties (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST IR phases — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final Elastic detection — https://www.elastic.co/guide/en/security/current/detection-engine-overview.html Splunk ES — https://docs.splunk.com/Documentation/ES (enterprise security literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/notes/soc-l1-duties.txt" <<'EOF'
L1 daily duties (literacy):
1. Monitor alert queue — YOUR seeded alerts.json
2. Enrich: who, what, when, where (user, host, src_ip, MITRE tag)
3. Correlate: jq failed logons + proxy blocks in YOUR logs
4. Document: triage worksheet + ticket — escalate per playbook
never: run offensive tools; only detection literacy on FAKE lab data
EOFCommand — copy this
grep -E 'L1|Enrich|never' "$SOC_LAB/notes/soc-l1-duties.txt"
python3 -c "print('L1 = first responder to alerts — document everything')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST IR phases (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); Elastic detection (https://www.elastic.co/guide/en/security/current/detection-engine-overview.html); Splunk ES (https://docs.splunk.com/Documentation/ES). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Escalation hygiene
Escalate with timestamp, log excerpts, affected asset list (lab fictional), and what you ruled out. Never escalate empty tickets or hide uncertainty — 'needs L2 review' is valid.
Defenders track SLA and handoff quality — students practice structured notes on lab tickets.
3. Literacy ≠ skipping tiers
Forbidden: L1 performing destructive containment on production without playbook. Allowed: tier card — L1/L2/L3 one duty each plus escalation trigger from $SOC_LAB alert.
Ship: tier and escalation card for YOUR lab alert. Next: Tools Overview.
4. What you ship: tier and escalation card for $SOC_LAB
L1/L2/L3 duties and escalation trigger on sample alert. $SOC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Tier card. $SOC_LAB named. File t29-m02-l02-roles-tiers.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Close every lab alert as false positive without notes. Escalate with zero context.
Right
Write tier and escalation card for YOUR $SOC_LAB alert. Next: Tools Overview.
Mission: map tiers on YOUR lab alert
1) List three L1 duties. 2) Name one L2 trigger from sample alert. 3) Write escalation sentence with evidence fields. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Good handoffs include what you already checked — saves L2 time.
Knowledge Check
APPLY: L1 analyst primary duty includes:
Multiple choice
Knowledge Check
APPLY: True or False: Escalating with timestamps and log excerpts is good hygiene.
True or False
Knowledge Check
APPLY: Tier literacy on Cyberlium uses:
Multiple choice