30 Day SOC Challenge Explanation

30-Day SOC Analyst Challenge Overview

Objective: Gain hands-on knowledge essential for a SOC Analyst role.

Program Structure

Week 1: ELK Stack Fundamentals

Introduction to ELK: Understand the components and significance of the ELK Stack.
Setting Up ELK: Learn how to install and configure Elasticsearch, Logstash, and Kibana.
Ingesting Logs: Practice ingesting logs, such as Sysmon, from endpoints into the ELK Stack.

Week 2: Understanding Attacks

Brute Force Attacks: Explore the nature of brute force attacks in cybersecurity.
Setting Up Public Servers: Learn how to set up public SSH and RDP servers for testing.
Creating Alerts and Dashboards: Develop skills in creating alerts and dashboards to monitor activities.

Week 3: Command and Control (C2)

Introduction to C2: Gain insights into command and control mechanisms used by attackers.
Setting Up a C2 Server: Learn to set up your own C2 server using Mythic.
Attacking Public Servers: Apply your knowledge by attacking designated public servers in a controlled environment.

Week 4: Incident Management

Introduction to Ticketing Systems: Understand the role of ticketing systems in incident response.
Integration of Ticketing Systems: Learn how to set up and integrate a ticketing system into your workflow.
Investigating Alerts: Review high-level strategies for investigating alerts generated during operations.

Conclusion

This structured approach ensures participants build foundational skills progressively, preparing them for real-world challenges in a SOC environment.