Security Analyst Intro
Triage Specialist
SOC responsibilities:
SIEM (Security information & event management)
Reporting
Ticketing
Log Collection
Knowledge Base
Research & Development
Aggregation & Correlation
Threat Intelligence
Preparation & Prevention
Stay informed of current cyber threats
Detect & hunt threats
Create security roadmap
Gather intelligence data on latest threats & associated TTP's
Maintain firewall signatures
Patch vulnerabilities
Block and safe-list apps, email addresses, IPs
Monitoring and Investigation
Use SIEM & EDR tools to monitor network activities
Prioritize alerts based on low, medium, high, & critical levels
Understand how, when, & why certain attacks work to mitigate threats
Coordinate and take action to isolate threat
Day in the Life of a Security Analyst
![](https://jacob-taylor.gitbook.io/~gitbook/image?url=https%3A%2F%2F309112325-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FdUCUPJ7E8b7n8AB8j3ms%252Fuploads%252FT5Cd6FtTiNFN8MLVF70Z%252Fimage.png%3Falt%3Dmedia%26token%3Df608b8eb-33ac-4aaa-8a18-9fce0a31320f&width=768&dpr=4&quality=100&sign=618f8588&sv=1)
What was the malicious IP address in the alerts?
![](https://jacob-taylor.gitbook.io/~gitbook/image?url=https%3A%2F%2F309112325-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FdUCUPJ7E8b7n8AB8j3ms%252Fuploads%252FrvIv4yty8UU0zO066VzG%252Fimage.png%3Falt%3Dmedia%26token%3D59cf5626-2c0f-4de5-bfe4-76740742dae6&width=768&dpr=4&quality=100&sign=606ee824&sv=1)
![](https://jacob-taylor.gitbook.io/~gitbook/image?url=https%3A%2F%2F309112325-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FdUCUPJ7E8b7n8AB8j3ms%252Fuploads%252FQPk48LqccF765mExmPgq%252Fimage.png%3Falt%3Dmedia%26token%3D71b28319-4423-46d2-8bd4-95f3a061ba69&width=768&dpr=4&quality=100&sign=d7a9c0e9&sv=1)
To whom did you escalate the event associated with the malicious IP address?
![](https://jacob-taylor.gitbook.io/~gitbook/image?url=https%3A%2F%2F309112325-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FdUCUPJ7E8b7n8AB8j3ms%252Fuploads%252FkmXOWm5RElyptkcm1one%252Fimage.png%3Falt%3Dmedia%26token%3Daf8d30e1-c154-40a9-b771-f808f410bfa7&width=768&dpr=4&quality=100&sign=34ecac19&sv=1)
Blocking the malicious IP address on the firewall:
![](https://jacob-taylor.gitbook.io/~gitbook/image?url=https%3A%2F%2F309112325-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FdUCUPJ7E8b7n8AB8j3ms%252Fuploads%252FdpdMkmr65XyBTRERKRiS%252Fimage.png%3Falt%3Dmedia%26token%3Da868e814-c70c-433a-9b2a-e5c16b569581&width=768&dpr=4&quality=100&sign=280e84fc&sv=1)
Last updated