SOC Analysis

7 notes

• EDR (Endpoint Detection & Response)

  As a soc analyst, the available level of visiblity determines how efficient your analysis and threat detection is going to be. You need detailed data from the…

  edr · socUpdated Sep 17, 2026

• Elastic Stack (ELK)

  Elastic Stack is a group of tools used to collect, store, search, and visualize data such as logs and security events. It commonly includes Elasticsearch for…

  elk · siem · socUpdated Sep 17, 2026

• SIEM (Security Information & Event Management)

  They are logs collected directly from an individual device, such as a laptop, desktop, server, or virtual machine. They show what is happening on that specific…

  siem · logs · socUpdated Sep 17, 2026

• SOAR

  It stands for Security Orchestration, Automation, and Response. It is a category of security tools that helps teams connect different security products,…

  soar · automation · socUpdated Sep 17, 2026

• SOC Frameworks — Pyramid of Pain

  Why a malware hash is the weakest indicator you can act on and a TTP is the strongest — mapped to what a SOC analyst should actually do at each level of the pyramid.

  pyramid-of-pain · threat-intel · socUpdated Sep 17, 2026

• Splunk (Core Components)

  Splunk Forwarder, Indexer, and Search Head are three main parts of a Splunk setup. They work together like this: the forwarder sends data, the indexer stores…

  splunk · siem · socUpdated Sep 17, 2026

• Windows Event Viewer (Quick Notes)

  Which Event ID is generated when event logs are removed? Event Id 104 Which Event ID is associated with Process Execution activity? In this case, Event ID 4688…

  windows · event-viewer · socUpdated Sep 17, 2026