SOC analyst

A SOC analyst owns the front of the detection and response pipeline. Alerts arrive from the SIEM, EDR, identity provider, cloud control plane and email gateway; the analyst qualifies each one against telemetry, scopes what else the indicator touched, and either closes it with a documented reason or escalates it as an incident with the timeline already assembled. The job is judged on two things a queue makes visible: how often the verdict is right, and how much of the reasoning survives for the next person. Writing a query is the mechanic; deciding what question to ask, and defending the answer, is the role.

• ·Triage the alert queue against SLA, working highest-confidence and highest-blast-radius first.
• ·Qualify alerts by querying source telemetry directly rather than trusting the alert summary.
• ·Scope an indicator across host, network, identity and cloud telemetry before calling it contained.
• ·Escalate with a written timeline, affected assets and the containment action you recommend.
• ·Preserve artifacts and keep the chain from observation to conclusion auditable.
• ·Feed detection engineering: tune noisy rules, file coverage gaps, propose new detections with a threshold and an owner.
• ·Run approved containment playbooks and know exactly which ones require a human approval gate.
• ·Hand off cleanly at shift change so the incoming analyst inherits state, not archaeology.

1. 08:00Shift handover
   Read the outgoing analyst's notes, pick up open cases still inside SLA, and confirm which containment actions are pending approval from last night.
2. 08:30Queue triage
   Work the overnight backlog. Most items resolve in a few minutes: a scanner, a patched service, an expected admin action. Each close carries a one-line reason and the query that supports it.
3. 10:00A real one
   A spray against a service account crosses threshold. Pivot auth → process → network → DNS → firewall, find the download and the beacon, and build the timeline while it is still cheap to build.
4. 11:30Escalation and containment
   Raise the incident, brief the incident lead, and run the isolation playbook — pausing at the approval gate because disabling a service account has a blast radius the automation cannot judge.
5. 13:00Detection feedback
   The rule fired late. Propose the tightened version with a window, a threshold defended against baseline, and an owner, then hand it to assurance for validation.
6. 15:00Hunting hour
   No alert, just a hypothesis: which hosts resolved a newly registered domain this week? Hunting is where tomorrow's detections come from.
7. 16:30Write-up and handover
   Close the case with the evidence attached, note the blind spot you could not cover, and leave the next shift a state summary rather than a pile of tabs.

• Query fluency in at least one SIEM dialect

  Aggregate, filter, join and time-bucket without a cheat sheet — and read the other four dialects well enough to review someone else's rule.

  qr-01-hunt-the-wireqr-02-hunt-the-endpointqr-03-hunt-the-identity
• Pivoting across telemetry families

  Carry an account, a process, an address and a domain forward across auth, process, network, DNS and firewall data without losing the thread.

  qr-08-hunt-the-spread
• Alert triage and case discipline

  Qualify, scope and prioritize into a case with evidence attached and a verdict someone else can audit.

  s-101t-101k-a01
• Detection engineering literacy

  Promote a search into a rule with a window, a threshold defended against baseline, a false-positive budget and a named owner.

  dr-401
• Response automation and approval gates

  Bind a query to a trigger, run a playbook, and know which actions must stop for a human — plus what a denied approval costs.

  f-101f-102c-201b-301k-c01
• Control assurance

  When a detection does not fire, localise it to collection, matching or notification instead of loosening the rule.

  dr-401k-b01
• Communication under time pressure

  A written escalation an incident lead can act on: what happened, what is affected, what you recommend, and what you could not see.

  k-b01k-c01

• SIEM: Splunk (SPL), Microsoft Sentinel (KQL), IBM QRadar (AQL), Elastic (ES|QL), CrowdStrike event search
• EDR and host telemetry: Sysmon, osquery, Wazuh
• Network: Zeek, Suricata, firewall and DNS logs
• Case and automation: SOAR playbooks, ticketing, approval gates
• Intel and analysis: MITRE ATT&CK, VirusTotal-class enrichment, CyberChef

What separates a good analyst

• Says 'I don't know yet' with a plan attached, rather than guessing a verdict.
• Closes noise fast and explains why, instead of leaving the queue to age.
• Writes the timeline while investigating, not afterwards from memory.
• Knows the blast radius of their own containment actions.
• Files the coverage gap they found even when it makes their own detection look worse.

• Detection engineer — owns the rules rather than consuming them.
• Incident responder — leads the scope and containment rather than escalating into it.
• Threat hunter — works from hypotheses instead of the queue.
• SOC lead — owns shift quality, SLA and the handover contract.