SOC Analyst & Blue Team: Log Investigation
Reconstruct an intrusion from raw logs using nothing but the shell — on sample data you generate in your own lab.
One-time payment · lifetime access · lessons, labs, exam and certificate included · no subscription.
About this course
This defensive course teaches the day-to-day craft of a SOC analyst: reconstructing an attack from raw logs with nothing but the shell. You generate a realistic sample set of SSH and web server logs in your own lab, then learn where logs live on Linux and how to read their formats. Using grep, awk, sort, uniq and cut, you filter noise, slice out fields like source IP and status code, and rank the top talkers. You learn the log signatures of a password brute-force and of web directory scanning, then correlate both into a single attack timeline. A detection-rules lesson turns patterns into shell alerts, and a final lesson covers writing a clear incident report. Each lesson has a quiz, with a final exam and certificate.