01 SOC Labs

For the EC-Council → Labs → SOC Labs section, I recommend a focused 15-lab sequence that takes the learner from basic SOC operations through complete incident investigation and reporting.

The overall methodology should be:

Alert → Validate → Investigate → Correlate → Scope → Contain → Evidence → Escalate → Report

And the core SOC principle should be:

An alert is a starting point for investigation—not proof of compromise.

Recommended SOC Lab Sequence

Lab	Title	Primary Skill
Lab 01	Build Your SOC Analyst Lab	SOC Environment Setup
Lab 02	Security Alert Triage & Prioritization	Alert Triage
Lab 03	Suspicious Authentication Investigation	Identity Investigation
Lab 04	Windows Security Event Investigation	Windows Log Analysis
Lab 05	Linux Authentication & System Log Investigation	Linux Log Analysis
Lab 06	Phishing Email Investigation	Email Security
Lab 07	Malware & Endpoint Alert Investigation	Endpoint Security
Lab 08	Network Security Alert Investigation	Network Detection
Lab 09	DNS & Web Traffic Investigation	Network/Proxy Analysis
Lab 10	SIEM Search, Filtering & Event Correlation	SIEM Analysis
Lab 11	Threat Intelligence & IOC Enrichment	Threat Intelligence
Lab 12	Incident Timeline Reconstruction	Evidence Correlation
Lab 13	Incident Scoping, Containment & Escalation	Incident Response
Lab 14	SOC Investigation Reporting & Case Documentation	SOC Reporting
Lab 15	Enterprise SOC Analyst Capstone	End-to-End Investigation

Lab Progression

The track should progress like this:

SOC Environment
      ↓
Alert Triage
      ↓
Identity Investigation
      ↓
Host Investigation
      ↓
Email Investigation
      ↓
Endpoint Investigation
      ↓
Network Investigation
      ↓
SIEM Correlation
      ↓
Threat Intelligence
      ↓
Timeline Reconstruction
      ↓
Incident Scoping
      ↓
Containment / Escalation
      ↓
Reporting
      ↓
Enterprise Capstone

Lab 01 — Build Your SOC Analyst Lab

Students establish the investigation environment they will reuse throughout the SOC labs.

They should learn:

SOC workstation setup
log-source organization
SIEM fundamentals
Windows event logs
Linux logs
endpoint telemetry
network logs
DNS logs
web/proxy logs
evidence directories
investigation journals
case numbering
timestamp handling
basic chain of custody

Primary outcome: reusable SOC investigation workspace.

Lab 02 — Security Alert Triage & Prioritization

This introduces the fundamental SOC workflow.

Students receive a small alert queue and determine:

which alerts are informational
which require investigation
which may be duplicates
which require escalation
which appear to be false positives

Methodology:

Alert → Context → Validate → Prioritize → Investigate / Close / Escalate

Concepts:

alert severity
confidence
asset criticality
user context
false positives
duplicate alerts
alert disposition
escalation criteria

Primary outcome: Alert Triage Register.

Lab 03 — Suspicious Authentication Investigation

Students investigate identity-focused alerts such as:

repeated failed authentication
successful login after multiple failures
unusual login time
unusual source address
privileged account authentication
account lockout
authentication from an unexpected system

Methodology:

Identity → Authentication Event → Source → Timeline → Baseline → Correlate → Determine Risk

Students must distinguish:

Failed Login
    ≠
Account Compromise

and:

Successful Login
    ≠
Malicious Login

Primary outcome: Authentication Investigation Report.

Lab 04 — Windows Security Event Investigation

Students work with Windows security telemetry.

Core areas:

successful logon events
failed logon events
account changes
privilege events
process events where supplied
service activity
system events
timeline correlation

Students learn:

Event ID → Host → User → Time → Activity → Context

Primary outcome: Windows Host Investigation Register.

Lab 05 — Linux Authentication & System Log Investigation

Students analyze Linux events such as:

SSH authentication
failed logins
successful login
sudo activity
service events
system log entries
account changes
unusual administrative activity

Sources may include:

/var/log/auth.log
/var/log/secure
journalctl output
application logs

The lab remains investigation-focused rather than offensive.

Primary outcome: Linux Security Investigation Report.

Lab 06 — Phishing Email Investigation

This should be one of the major SOC labs.

Students receive a simulated suspicious email and investigate:

sender
recipient
subject
timestamps
reply-to
message routing
URLs
attachment metadata
authentication results
user impact
IOC extraction

Methodology:

Email → Header → Sender → URL/Attachment → IOC → User Exposure → Correlation → Disposition

Classifications:

benign
spam
suspicious
phishing
malicious
inconclusive

No opening potentially unsafe attachments outside the designated lab environment.

Primary outcome: Phishing Investigation Case.

Lab 07 — Malware & Endpoint Alert Investigation

Students investigate a simulated endpoint detection alert.

They analyze:

affected endpoint
user
process
parent process
command-line evidence supplied by the lab
file information
hash
network connection
detection timestamp
additional alerts
persistence indicators if present in supplied evidence

Methodology:

Endpoint Alert → Process → File → User → Network → Timeline → Scope → Disposition

Key principle:

Malware detection ≠ Complete host compromise automatically.

Primary outcome: Endpoint Investigation Report.

Lab 08 — Network Security Alert Investigation

Students work with a network IDS/IPS or firewall-style alert.

Investigate:

source IP
destination IP
ports
protocol
rule/signature
direction
asset ownership
frequency
related events
allowed vs blocked action

Methodology:

Network Alert → Source → Destination → Service → Direction → Context → Correlation

Important distinction:

IDS Alert
    ≠
Successful Attack

Primary outcome: Network Alert Investigation Register.

Lab 09 — DNS & Web Traffic Investigation

Students investigate suspicious network activity using DNS and HTTP/proxy evidence.

Examples:

unusual domain
repeated DNS requests
suspicious web destination
abnormal HTTP response
new domain interaction
unexpected application traffic

Students analyze:

Client
  ↓
DNS Query
  ↓
Resolved Address
  ↓
Web Connection
  ↓
Response

They correlate DNS and web events rather than treating each independently.

Primary outcome: DNS/Web Investigation Timeline.

Lab 10 — SIEM Search, Filtering & Event Correlation

This is a critical SOC analyst lab.

Students learn how to move from:

One Alert

to:

Multiple Related Events

using searches and filters.

The lab should cover concepts such as:

time-range filtering
host filtering
user filtering
source/destination filtering
event-type filtering
event correlation
pivoting between data sources
saving investigation queries
evidence export

Methodology:

Alert → Search → Pivot → Correlate → Timeline → Conclusion

Primary outcome: SIEM Investigation Worksheet.

Lab 11 — Threat Intelligence & IOC Enrichment

Students enrich indicators such as:

IP addresses
domains
URLs
file hashes
sender addresses

The emphasis should be on analyst judgment.

Teach:

IOC Match
    ≠
Compromise Proven

Threat intelligence should help answer:

Is the indicator known?
How recent is the intelligence?
What confidence does the source provide?
Does local evidence support the intelligence?
Is the indicator relevant to this incident?

Primary outcome: IOC Enrichment Register.

Lab 12 — Incident Timeline Reconstruction

This lab teaches one of the most important analyst skills.

Students correlate evidence from:

authentication
endpoint
Windows
Linux
DNS
firewall
proxy
email
SIEM

into one timeline.

Example:

09:02
Phishing email received

09:07
User accessed URL

09:08
Endpoint alert generated

09:10
DNS query observed

09:11
Outbound connection detected

09:15
SOC alert created

Teach:

Correlation does not mean causation unless evidence supports the relationship.

Primary outcome: Master Incident Timeline.

Lab 13 — Incident Scoping, Containment & Escalation

Students determine:

how many hosts are affected
how many accounts are affected
earliest known activity
latest known activity
related alerts
affected business services
whether containment is required
whether escalation is required

Methodology:

Evidence → Scope → Impact → Priority → Containment → Escalation

Potential containment decisions can include:

Isolate Endpoint

Disable Test Account

Block Indicator

Restrict Network Path

Preserve Evidence

Students should document the decision rather than performing disruptive actions unless the lab is specifically designed for it.

Primary outcome: Incident Scope & Escalation Register.

Lab 14 — SOC Investigation Reporting & Case Documentation

This converts investigation evidence into professional SOC documentation.

Students create:

case ID
incident summary
alert source
affected assets
affected identities
investigation timeline
evidence
IOC list
analyst assessment
incident classification
severity
confidence
containment recommendation
escalation
remediation
lessons learned

Core principle:

A SOC case should tell another analyst exactly what happened, what was checked, what remains unknown, and what should happen next.

Primary outcome: complete SOC Case Report.

Lab 15 — Enterprise SOC Analyst Capstone

This should combine the entire SOC methodology.

Students receive a simulated enterprise incident containing evidence across several sources.

For example:

Suspicious Email
       ↓
User Interaction
       ↓
Endpoint Alert
       ↓
DNS Activity
       ↓
Network Connection
       ↓
Authentication Event
       ↓
SIEM Alerts
       ↓
SOC Investigation

Students must independently perform:

alert triage
identity investigation
email investigation
endpoint investigation
Windows/Linux log analysis
network investigation
IOC enrichment
SIEM correlation
timeline reconstruction
incident scoping
severity assignment
containment recommendations
escalation
final reporting

The final workflow becomes:

Alert → Validate → Investigate → Correlate → Scope → Contain → Escalate → Report

Capstone Deliverables

Students should submit:

Alert Triage Register
Asset & Identity Register
Authentication Analysis
Email Investigation
Endpoint Investigation
Network Investigation
IOC Register
SIEM Correlation Worksheet
Master Incident Timeline
Scope Assessment
Incident Classification
Severity & Confidence
Containment Recommendations
Escalation Decision
Positive Security Controls
Final SOC Incident Report

Recommended SOC Finding Classifications

Throughout all labs, keep the disposition vocabulary consistent:

Benign

Expected Activity

False Positive

Suspicious

Confirmed Security Incident

Potential Incident

Inconclusive

Escalated

And teach students to keep severity and confidence separate.

For example:

Severity:
High

Confidence:
Medium

Professional SOC Takeaway

A weak SOC workflow looks like:

Alert
 ↓
Looks Bad
 ↓
Incident
 ↓
Block Everything

A professional workflow looks like:

Alert
  ↓
Validate
  ↓
Understand User / Host / Network Context
  ↓
Search Related Evidence
  ↓
Correlate Events
  ↓
Build Timeline
  ↓
Determine Scope
  ↓
Assess Impact
  ↓
Decide Containment / Escalation
  ↓
Document Evidence
  ↓
Report

Students should repeatedly learn these distinctions:

Alert
  ≠
Incident

IOC Match
  ≠
Compromise

Failed Authentication
  ≠
Account Compromise

Malware Detection
  ≠
Entire Network Compromised

IDS Alert
  ≠
Attack Success

Suspicious Activity
  ≠
Confirmed Malicious Activity

No Additional Evidence
  ≠
Incident Never Happened

The central question for the entire SOC Labs track should be:

“Can you take an alert, investigate it using multiple security data sources, determine what actually happened, assess its scope and impact, and communicate the result clearly enough for the organization to act?”

Recommended Starting Point

➡️ Lab 01 — Build Your SOC Analyst Lab

We should build this one first in the same detailed GoHackersCloud Mission format as the Network Pentesting Labs, then continue Lab 02 → Lab 15 in sequence.