SOC › Module 2 › Lesson 3
Tools Overview
Tools overview literacy names SIEM, EDR, ticketing, and enrichment sources — map tool roles on YOUR $SOC_LAB workflow card without live vendor login.
Visual · t29_tools_overview
SOC tools literacy. $SOC_LAB only. Original Cyberlium.
Opening
SIEM correlates, EDR watches endpoints, tickets track work — literacy names the stack before you click stranger consoles.
Common SOC tools: SIEM (Splunk, Elastic, Sentinel) for log search and rules; EDR (CrowdStrike, Defender, SentinelOne) for endpoint telemetry; ticketing (ServiceNow, Jira) for workflow; enrichment (VT, WHOIS, internal CMDB) for context. SOAR may automate playbooks — L1 still validates outcomes. Cyberlium maps tool roles on YOUR $SOC_LAB workflow diagram — sample JSON in, ticket note out — never credentials for production vendor tenants. Next: Fundamentals Lab.
1. Tool classes (named)
SIEM: ingest, search, alert rules, dashboards. EDR: process, network, file events on endpoints. Ticketing: priority, assignee, SLA, audit trail. Enrichment: threat intel and asset context — use lab-safe fictional IOCs only.
On $SOC_LAB, draw alert flow: log source → SIEM rule → L1 queue → ticket → escalation.
Command guide
Try these commands — Tool classes (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK matrix — https://attack.mitre.org/matrices/enterprise/ Sigma rule format — https://github.com/SigmaHQ/sigma/wiki/Specification FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
curl -sS https://attack.mitre.org/matrices/enterprise/ | head -10
cat > "$SOC_LAB/notes/escalation-triggers.txt" <<'EOF'
Escalate to L2 when (literacy):
- confirmed malicious IP in YOUR proxy.jsonl + auth failures
- ransomware/malware keywords in YOUR alerts (seeded only)
- privilege escalation pattern (4624 admin from rare IP)
- executive account in alert — follow org playbook
lab: document trigger in ticket — never live attack to validate
EOFCommand — copy this
grep -E 'Escalate|malicious|lab:' "$SOC_LAB/notes/escalation-triggers.txt"
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK matrix (https://attack.mitre.org/matrices/enterprise/); Sigma rule format (https://github.com/SigmaHQ/sigma/wiki/Specification); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why tool literacy precedes certification chasing
Vendor certs help but employers hire analysts who understand workflow — what to search, when to escalate, how to document. Tool names change; triage discipline persists.
Students label tools on lab diagrams before paying for stranger-tenant practice exams.
3. Ethics: no stranger vendor consoles
Forbidden: using trial abuse or leaked creds to 'learn Splunk' on production. Allowed: tools card — four classes, one example product each, $SOC_LAB sample path.
Ship: SOC tools workflow card for YOUR lab. Next: Fundamentals Lab.
4. What you ship: SOC tools workflow card for $SOC_LAB
SIEM, EDR, ticket, enrichment roles on sample path. $SOC_LAB named. NO live vendor login. chmod 600.
5. What you record before the next lesson
Date. Tools card. $SOC_LAB named. File t29-m02-l03-tools-overview.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip ticketing because SIEM search is fun. Use leaked EDR console for practice.
Right
Write SOC tools workflow card for YOUR $SOC_LAB path. Next: Fundamentals Lab.
Mission: diagram tools on YOUR lab workflow
1) Name four tool classes. 2) Draw sample alert path on paper or text. 3) Note where L1 stops and L2 starts. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Tickets are evidence — if it is not documented, it did not happen on shift.
Knowledge Check
APPLY: SIEM primary role in SOC:
Multiple choice
Knowledge Check
APPLY: True or False: Ticketing tracks priority, assignee, and audit trail for alerts.
True or False
Knowledge Check
APPLY: Tools literacy on Cyberlium avoids:
Multiple choice