SOC › Module 1 › Lesson 1
Why SOC L1
SOC Level 1 literacy means triage, log reading, and detection vocabulary on YOUR $SOC_LAB — not probing production SIEMs or stranger networks you do not own.
Visual · t29_why_soc_l1
SOC scope literacy. $SOC_LAB only. Original Cyberlium.
Opening
Alerts flood the queue — Cyberlium teaches L1 analyst vocabulary and lab ethics, not unauthorized access to employer or stranger SIEM consoles.
SOC Level 1 work spans alert triage, log correlation, ticket hygiene, and escalation to senior tiers. Analysts need this vocabulary to read runbooks, MITRE mappings, and incident reports — not to run exploit scripts against live targets or query production Splunk without authorization. Cyberlium Topic 29 teaches on $SOC_LAB — YOUR sample Windows auth logs, Linux syslog snippets, proxy JSON, and synthetic alerts you author under $HOME/cyberlium-lab/t29-soc/. You will name detection classes and lab boundaries — never production SIEM access you do not own or offensive exploit cookbooks. Next: Lab Logs Only.
1. What SOC L1 covers (named)
SOC L1 includes alert monitoring, initial triage, log review (auth, DNS, proxy), false-positive vs true-positive judgment, ticket documentation, and escalation to L2/L3. One mis-scoped query can expose PII or violate employer policy.
Literacy means you can name these duties when reading a SOC runbook or job description — not that you can log into any Splunk instance you find credentials for.
Command guide
Try these commands — What SOC L1 covers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ (detection mindset literacy) Sigma rules — https://sigmahq.io/ (portable detection rule format) NIST IR — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final (incident handling literacy) FIRST CSIRT — https://www.first.org/ (SOC community context)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('SOC L1 literacy: triage YOUR seeded logs — never dump stranger SIEM or attack live networks')"
curl -sS https://attack.mitre.org/ | head -10
curl -sS https://sigmahq.io/ | head -8Primary tools to practice this lesson: python3, curl. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Sigma rules (https://sigmahq.io/); NIST IR (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST CSIRT (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Who needs SOC L1 vocabulary
Junior analysts start shift work with structured triage. IT staff crossing into security need log-source names and SIEM basics. Students practice alert workflows on fake logs before touching real user data or production tenants.
Cyberlium assumes YOU practice on $SOC_LAB — synthetic auth failures, courseware JSON samples, self-authored proxy logs — not employer production without ticket scope or stranger cloud SIEM tenants.
3. What this topic will never call practice
Querying production Splunk/Elastic you do not own, importing victim PCAP dumps without authorization, sharing live alert queues in public chat, phishing exploit kits labeled 'for detection,' or brute-force scripts against real login portals.
Ship a sentence: Topic 29 here means defensive SOC literacy and lab ethics on MY $SOC_LAB sample logs only. Next lesson: Lab Logs Only.
4. What you ship: SOC topic scope scoped to $SOC_LAB literacy
Write literacy vs unauthorized SIEM access in one paragraph. Dest = $SOC_LAB sample logs. NEVER production tenants. Notes chmod 600.
5. What you record before the next lesson
Date (UTC). Topic scope. Lab = $SOC_LAB. NEVER production SIEM or stranger logs. Path: $HOME/cyberlium-lab/t29-m01-l01-why-soc-l1.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Query a leaked Splunk token 'for learning.' Treat Topic 29 as a free pass to triage stranger employer alerts.
Right
Define SOC L1 literacy and name $SOC_LAB as the only practice surface. Next: Lab Logs Only.
Mission: define Topic 29 for YOUR SOC lab
1) Write literacy vs unauthorized SIEM access in one paragraph each. 2) Write a NEVER list (production SIEM, stranger logs, exploit cookbooks). 3) Name $SOC_LAB as your placeholder. Never aim queries at tenants outside your scoped lab.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: 'Hint only: what does L1 triage mean?' — not how to brute-force a live login portal.
Knowledge Check
APPLY: SOC L1 on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Topic 29 includes querying production SIEM tenants you do not own.
True or False
Knowledge Check
APPLY: Primary output of this topic supports:
Multiple choice