Skip to main content

Tutorials

Step-by-step tutorials for SOC analysts: log analysis, KQL and Sigma, SIEM and XDR investigation, and hands-on alert triage you can practice on SOCSimulator.

Tutorials articles

Page 2 of 2

Abstract rows of dark glass slats receding diagonally with a warm orange glow, evoking scrolling log lines

Tutorials

Windows Event Logs: Where They Live and How to Read Them

Windows event logs are .evtx files in C:\Windows\System32\winevt\Logs. Read the channels that matter to a SOC and preserve a copy as evidence.

Astrid Lindqvist20 min read
Abstract dark grid of glass panels receding into shadow, lit by a warm orange glow, evoking the MITRE ATT&CK matrix

Tutorials

MITRE ATT&CK for SOC Analysts: Tactics, IDs, Examples

All 15 Enterprise tactic IDs (Lateral Movement is TA0008), how techniques nest under them, and a worked alert chain mapped to ATT&CK step by step.

Astrid Lindqvist24 min read
Person at a MacBook Pro with a messaging app open in a cafe, simultaneously scrolling on a smartphone, iced drink on the table

Tutorials

Phishing Email Examples: 15 Analyzed by a SOC Analyst

Phishing email examples analyzed with real analyst eyes: red flags, header tells, and the patterns every security-aware person should recognize.

Astrid Lindqvist23 min read
Silhouetted figures standing inside a dark immersive installation with cascading blue-white data lights falling like rain around them

Tutorials

SIEM Use Cases: 10 Every SOC Runs (With Detection Logic)

SIEM use cases explained with detection logic sketches, data sources, and tuning notes for the 10 detections every SOC team operates.

Astrid Lindqvist18 min read
Windows Security event log entries displayed in a SIEM console, showing event IDs for authentication and process activity

Tutorials

Windows Event IDs & Codes Cheat Sheet: The 31 That Matter

The 31 Windows event IDs and codes SOC analysts triage most: logon, Kerberos, process, services, Sysmon, log clearing, plus detection pages for 12 of them.

Astrid Lindqvist18 min read
Network traffic analysis dashboard showing TCP and UDP port connections, firewall logs, and protocol distribution for SOC triage

Tutorials

Common Port Numbers Cheat Sheet: 42 Ports for SOC Triage

The 42 TCP/UDP port numbers SOC analysts read in firewall logs and SIEM alerts, what each one means in triage, and a printable cheat sheet image to save.

Astrid Lindqvist21 min read
Wax-sealed envelope beside a magnifying glass on a dark surface with a glowing phishing hook and orange code overlay in the background

Tutorials

How to Analyze a Phishing Email: SOC Walkthrough

A step-by-step SOC workflow to analyze a phishing email: safe handling, header forensics, URL and attachment triage, and a documented verdict.

Astrid Lindqvist18 min read
Close-up of a dark SIEM dashboard on a widescreen monitor, rows of alerts highlighted in orange, gloved hands at the keyboard

Tutorials

Alert Triage: Real Threats vs False Positives

Alert triage is the core SOC skill. Learn the framework analysts use to assess severity, confirm IOCs, and separate real threats from false positives.

Astrid Lindqvist14 min read