Ravindra BagaleCourses & study guides मराठी Track your progress

31. SOC, SIEM and Incident Response

By Last updated:

Chala mitrano, aattaparyant aapan attacker cha drushtikon baghitla – scan, exploit, crack. Pan company madhe sarvat jast jobs defence baju la aahet: SOC (Security Operations Centre). SOC analyst che kaam mhanje logs baghne, alert samjun ghene, ani attack zala tar tyala thambavne. Ya chapter madhe logs kuthe astat, SIEM kay karto, Wazuh sarkha free tool kasa vaparaycha, ani incident zala tar step-by-step kay karaycha he shiku. Fresher sathi SOC analyst ha sarvat common entry job aahe, mhanun he chapter lakshapurvak vacha. Samjla ka? Chala!

What you will learn in this chapter

  • What a SOC is, its tiers (L1, L2, L3) and daily work
  • Where logs live on Linux, Apache/Nginx, Windows and AWS
  • What a SIEM does, with Splunk, the ELK stack and Wazuh compared
  • Setting up Wazuh in your lab and seeing real alerts from your own attacks
  • Alert triage: true positive, false positive, severity and escalation
  • The incident response lifecycle (NIST) with a worked example

Lab scope

Generate alerts only by attacking your own lab machines (Kali against Metasploitable/DVWA on the host-only network, Chapter 18). Never test detection by attacking real systems.

Concepts in this chapter

  1. 31.1What a SOC Is
  2. 31.2Where Logs Live
  3. 31.3What a SIEM Does
  4. 31.4Wazuh Lab: See Your Own Attacks
  5. 31.5Alert Triage
  6. 31.6The Incident Response Lifecycle
  7. 31.7Red vs Blue, Project and Real Incidents
  8. 31.8EDR and XDR
  9. 31.9MITRE ATT&CK
  10. 31.10Threat Hunting
  11. 31.11SOAR: Security Automation

The chapter recap is at the end of the last concept page.

Chapter 31: SOC, SIEM and incident response — practice tasks

Open chapter lessons · Full guided lab: soc read login log brute force incident note (not repeated here)

31.1 Write an incident note from a log

MediumBanking

Why: SOC analysts turn logs into tickets.

What: Use the data file and write Who/What/When/Impact/Next.

Data file: auth.csv

TimeResultUserIP
10:01Failedroot203.0.113.7
10:02Failedadmin203.0.113.7
10:03Failedroot203.0.113.7
10:05Acceptedravi192.0.2.10

About this file: Made-up auth events. Each row is one attempt. Columns: Time; Result; User; IP.

How:

  1. Count fails per IP.
  2. Note the successful login after fails.

Expected output: 203.0.113.7 failed 3×; separate success from 192.0.2.10 — document both.

Hint

Keep to facts.

Answer / how to check
  1. Note has five short sections.

31.2 Severity triage (paper)

EasyRetail

Why: Not every alert is Sev-1.

What: Assign Sev-1 to Sev-4.

Data file: alerts.csv

Alert
Ransomware note on file server
User reports suspicious email
Port scan from internet (blocked)
Checkout API down for all shops

About this file: Made-up alerts. Each row is one alert to triage.

How:

  1. Read each alert.
  2. Think of customer impact.

Expected output: Ransomware Sev-1; phishing report Sev-3; scan noise Sev-4; payment outage Sev-1.

Hint

When unsure, escalate.

Answer / how to check
  1. Two Sev-1 items.

31.3 Build a simple SIEM query habit

MediumIT

Why: Queries beat scrolling.

What: Find failed SSH in the last hour on your lab.

How:

  1. sudo journalctl -u ssh --since "1 hour ago" | grep Failed | wc -l
  2. Group by IP with awk/sort/uniq.

Expected output: A count and top IPs.

Hint

Save the command as a note.

Answer / how to check
  1. Top IP list produced.

Extended teaching notes

Why this lesson matters

Part 11 turns tool skills into professional defensive practice: web risks, cloud, SOC work, hardening, cryptography, Indian law and careers. Every example below stays inside systems you own or public teaching material.

Indian company (sample data)

Suppose we are a junior security engineer at an Infosys or TCS client project. You take this lesson's checklist, map it to three production services (for example a Spring Boot API, a Node.js portal and a Python job), and open tickets with evidence and owners.

Global practice

Follow public guidance from OWASP, CERT-In, CISA and cloud provider Well-Architected / security pillars. Cite them in reports.

Everyday analogy

A cricket team that only practises hitting but never fielding loses matches. Offence skills in a lab exist to improve fielding in real systems.

Apply across stacks

Wherever code appears, ask the same questions.

Java / Spring Boot

Parameterise queries, encode output, limit Actuator, patch dependencies.

.NET

EF Core parameters, HTTPS, Data Protection API, patch NuGet.

Node.js

helmet, parameterized SQL, npm audit, lockfiles.

Python

ORM, autoescape, pip-audit, Bandit.

Go / PHP / Ruby

Safe templates, prepared statements, govulncheck / composer audit / Brakeman.

nginx / Apache / Tomcat

Hide versions, TLS, least-open ports.

MySQL / PostgreSQL / MongoDB / Redis

No public ports, auth on, least-privilege users.

AWS / Azure / GCP

Roles not keys, private data stores, cloud logs on.

Defender worksheet

  1. Write a 5-line summary.
  2. Name one related public breach or advisory.
  3. Practise one safe command on a lab you own.
  4. Write the fix for a teammate.

Recap

  • Permission first.
  • Fix over spectacle.
  • Evidence in notes.

Defender's worksheet (do this today)

  1. Write the lesson title and date.
  2. List three owned systems where it applies.
  3. Run one safe lab check and paste evidence.
  4. Write a two-sentence fix for a teammate.
  5. Note one CERT-In or CISA advisory that relates (title + date).

Indian workplace (sample)

At a Wipro or LTIMindtree client SOC, turn this lesson into one playbook step with an owner and a due date.

Global practice

Compare your notes with OWASP, CIS Benchmarks or a cloud Well-Architected security question. Write the overlap in five lines.

Family test

Explain the risk and the fix without jargon. If a parent or sibling can repeat the warning, you are ready to teach juniors.

Common mistakes

  • Skipping permission.
  • Tool collecting without fixing.
  • Publishing lab screenshots that contain secrets.
  • Treating encoding as encryption.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.

Key terms for this page

  • Control: a safeguard (patch, config, process).
  • Finding: a weakness with evidence.
  • Remediation: the fix and how you verified it.
  • Scope: systems you are allowed to touch.
  • Least privilege: only the access required for the task.
  • Defence in depth: several controls in layers.

Mini case study

Suppose we are a junior engineer at Zoho or Freshworks (sample data). A weekly review asks each person to present one control from their area. You pick a control from this lesson, show a before/after screenshot from a lab, and list the production ticket you would open. That habit builds both skill and credibility.