SOC Analyst Flashcards

Tier 1 (Triage Analyst): Monitor SIEM, triage alerts, classify events. Tier 2 (Incident Handler): Investigate escalated incidents, collect evidence, contain threats. Tier 3 (Threat Hunter): Proactively hunt for threats, perform advanced forensics, create detection rules.

Click to see question

1. True Positive (TP) — confirmed malicious. 2. False Positive (FP) — alert triggered but no threat. 3. Benign Activity — malicious-looking but legitimate. 4. Suspicious — cannot determine with available info. 5. Confirmed Incident — active breach requiring immediate response.

Click to see question

Acknowledge within 5 minutes, Triage within 15 minutes, Escalate within 30 minutes. If not acknowledged in 5 minutes, auto-escalate to L2 on-call.

Click to see question

Unacknowledged P1 alerts in the SIEM were dismissed for weeks because there was NO auto-escalation mechanism. Every alert must have an escalation path — if not acknowledged in 5/15/30 minutes, it auto-escalates to senior analysts.

Click to see question

SIEM (Security Information and Event Management) aggregates logs from across the environment (firewalls, servers, cloud) and correlates them. EDR (Endpoint Detection and Response) focuses on endpoint telemetry — process execution, network connections, file operations — on individual devices.

Click to see question

Security Orchestration, Automation, and Response. SOAR automates repetitive SOC tasks (enrichment, containment) through playbooks, reducing response time from hours to minutes.

Click to see question

1. Preparation. 2. Detection & Analysis. 3. Containment, Eradication & Recovery. 4. Post-Incident Activity.

Click to see question

The sequence for collecting evidence based on how quickly it changes: CPU registers > RAM > network connections > running processes > disk > backups. Collect the most volatile data first because it disappears quickly.

Click to see question

Internal SOC (in-house team), MSSP (outsourced), Hybrid (internal + MSSP), Co-Managed (MSSP handles T1, internal handles T2-T3), Virtual SOC (distributed remote team).

Click to see question

Playbook: End-to-end incident response process (e.g., Phishing Response). Runbook: Specific technical steps (e.g., how to use URLScan). Procedure: Organizational policy (e.g., Data Classification Policy). Playbooks are broader, runbooks are more detailed technical guides.

Click to see question

5-6 analysts per seat (to cover shifts, PTO, and sick leave). A minimum viable 24/7 SOC requires 8-10 analysts total.

Click to see question

Static analysis examines malware without executing it (file type, hashes, strings, PE headers, YARA rules). Dynamic analysis executes the malware in a sandbox to observe behavior (network traffic, process creation, registry changes).

Click to see question

MTTD (Mean Time to Detect) — time from compromise to detection. MTTR (Mean Time to Respond) — time from detection to containment. False Positive Rate — FPs as percentage of total alerts.

Click to see question

Threat hunting proactively searches for threats that evaded existing detection, using hypotheses based on threat intelligence. Unlike alert-driven detection (reactive), hunting finds unknown threats by analyzing baseline behavior and looking for anomalies.

Click to see question

A model showing how difficult it is for attackers to change different indicators. From easiest (bottom) to hardest (top): Hash values → IP addresses → Domain names → Network/host artifacts → Tools → TTPs. TTPs (Tactics, Techniques, Procedures) are the hardest for attackers to change.

Click to see question

A document that tracks evidence from collection through analysis to court presentation. It records who handled the evidence, when, and what was done. Critical for evidence admissibility in legal proceedings and regulatory investigations.

Click to see question

Environmental noise (35% — legitimate activity looking malicious), Misconfiguration (25% — thresholds too low), Outdated rules (20% — rules no longer relevant), Legitimate software behavior (15% — approved tools triggering detection), Vulnerability scanners (5% — scanning tools setting off rules).

Click to see question

L1: CompTIA Security+ or GSEC or BTL1. L2: GCIH (Incident Handling) or GCFA (Forensic Analysis) or CISSP. L3: GREM (Reverse Engineering) or GXPN (Exploit Research) or OSCP.

Click to see question

~45% monitoring and triage, ~20% investigation, ~15% training and development, ~10% shift handover and documentation, ~10% false positive analysis and tuning.

Click to see question

79 minutes. This means from initial compromise, an attacker can begin spreading laterally in just over an hour. T1 triage must happen faster than this.

Click to see question

The tuning feedback loop. T1 analysts who identify false positive patterns and suggest rule tuning improvements directly reduce alert volume and improve the entire SOC's efficiency.

Click to see question

A collaborative exercise where red team performs attack techniques and blue team tests detection capabilities. The goal is to identify detection gaps and improve detection rules, not to compete. Findings are used to create new detection rules.

Click to see question

Velociraptor is an open-source endpoint visibility and hunting tool. It allows T3 analysts to deploy VQL (Velociraptor Query Language) queries across thousands of endpoints simultaneously for threat hunting, forensic collection, and real-time monitoring.

Click to see question

1. Host isolation (EDR — seconds). 2. Account disable (seconds). 3. Network block (firewall ACL — minutes). 4. Session termination (minutes). 5. Application quarantine (minutes). 6. Network segmentation (hours — needs change management).

Click to see question

MSSP handles ALL SOC functions (T1-T3) for the client. Co-managed SOC splits responsibility — MSSP handles T1 triage while the internal team handles T2 investigation and T3 hunting. Co-managed gives more internal control.

Click to see question