A SOC analyst's starter kit
Every year I help train a new group of SOC interns. Each cohort asks some version of the same question in the first week: what should I learn first? There is so much to know in security that the honest answer, "everything, eventually", is not very useful.
This is the more useful answer. It is the starter kit I would hand to anyone in their first year as a SOC analyst: a handful of tools worth learning well, the core skills that come up every shift, and the habits that turn a fast analyst into a good one.
The tools worth learning first
Your employer will give you a SIEM, an EDR and a ticketing system, and you will learn those on the job. Alongside them, these free tools come up constantly and are worth getting comfortable with on your own time.
| Tool | What it is for |
|---|---|
| CyberChef | Decoding, decompressing and transforming data: base64, URL encoding, hex, timestamps |
| VirusTotal | Reputation for files, hashes, URLs, domains and IPs, with relationships between them |
| urlscan.io | Safely seeing what a URL loads, redirects to and looks like, without visiting it yourself |
| An email header analyser | Reading SPF, DKIM and DMARC results and tracing the real path of a message |
| Wireshark | Understanding network traffic at the packet level, even if you rarely capture it at work |
| MITRE ATT&CK | A shared vocabulary for attacker behaviour, and a map of what to look for next |
| A scripting language | Python is the usual choice, for parsing logs, calling APIs and automating repetitive work |
One warning about reputation services: anything you upload may become visible to others. Never submit internal documents or files that could contain sensitive data. Search by hash first.
The skills that come up every shift
- Reading logs fluently. Authentication logs, process creation events, proxy and DNS logs, and cloud audit logs. Learn what normal looks like for each, so abnormal stands out.
- Building a timeline. Most investigations come down to putting events in order and spotting the gap or the step that does not fit. Always convert to one timezone first.
- Email analysis. Phishing is still one of the most common things you will triage. Learn to read headers, check sender authentication, inspect links and attachments safely and spot lookalike domains.
- Knowing the operating systems. What a normal Windows process tree looks like, where persistence hides, how macOS and Linux differ. You cannot spot a strange parent process if you do not know the usual one.
- Basic networking. Ports, protocols, DNS, HTTP, TLS and what NAT does to your source IPs. Half of all confusion in investigations is a networking misunderstanding.
- Identity basics. How single sign-on, MFA, sessions and tokens work. Modern attacks increasingly target identity rather than machines.
The habits that matter more than the tools
After several intern cohorts, the analysts who grow fastest are rarely the ones who knew the most on day one. They are the ones with good habits.
- Write things down as you go. Every action, query and finding goes in the ticket with a timestamp. Future you, your shift lead and the incident report will all thank you.
- Write tickets for the next analyst. A good ticket answers what happened, what you checked, what you found and why you closed it, so someone reading it in six months understands without asking.
- Ask "how do I know?" Before closing an alert, ask what evidence actually supports your conclusion. "It looked fine" is not evidence.
- Escalate early and without embarrassment. A question that turns out to be nothing costs a few minutes. A real incident you sat on because you were unsure costs far more. Good teams want you to ask.
- Learn one thing from every alert. Even a false positive teaches you something about the environment: a tool, a team, a process. Keep a personal notes file of what you learn.
- Automate the third repetition. The first time you do something, learn it. The second time, notice it. The third time, script it or ask whether it can be automated.
- Protect your energy. SOC work has a real burnout risk. Take breaks, hand over properly, and remember that the queue will still be there tomorrow.
A suggested first-year path
Everyone learns differently, but this rough order has worked well for the interns I have trained:
- Months 1 to 3: learn the environment and the tools. Shadow senior analysts. Triage simple alert types with review. Get fast and accurate at phishing analysis.
- Months 4 to 6: handle the full L1 queue independently. Start writing short notes on alert types you see often. Learn the ATT&CK techniques behind your most common alerts.
- Months 7 to 9: join investigations as a second analyst. Learn to build timelines and write incident summaries. Write your first small script.
- Months 10 to 12: propose a detection improvement or a tuning change for a noisy rule. Run a small hunt with a senior analyst. Teach something to the next new starter.
That last step matters more than it looks. Explaining something to someone else is the fastest way to find out what you do not understand yet.
On AI tools
New analysts now start with AI assistants available from day one. Use them, but use them the right way. Let them explain an unfamiliar command line, summarise a long log, or draft a ticket you then check. Do not let them make the decision for you, and never paste sensitive data into a tool your employer has not approved. The analysts who will do best are the ones who understand the fundamentals well enough to know when the AI is wrong. I have written more about this in AI will not replace L1 SOC analysts.
Certifications and learning resources
Certifications can help you get an interview, but they are not a substitute for hands-on practice. Free and low-cost options that build real skills include blue-team challenge platforms, capture-the-flag events with forensics and log-analysis tracks, home labs with a free SIEM and a few virtual machines, and public incident reports from security vendors and government agencies. Reading how real attacks unfolded is some of the best training available, and it costs nothing.
Frequently asked questions
Do I need to know how to code? Not on day one, but basic scripting quickly becomes one of the most useful skills you have. Being able to parse a log file or call an API saves hours every week.
How do I get better at spotting what is abnormal? Spend time looking at normal. Review a few clean authentication logs, process trees and email headers every week until the patterns become familiar. Abnormal will start to jump out.
What if I close an alert that turns out to be real? It happens to everyone eventually. Say so quickly, help with the response and take part in the review. Teams care far more about how you handle a miss than about never missing anything.
The point
Your first year in a SOC is not about knowing everything. It is about building a foundation: a few tools you know well, the core skills of logs, timelines and email analysis, and habits that make your work trustworthy. Get those right and the advanced topics, from threat hunting to detection engineering, build naturally on top. Everyone senior in this field started exactly where you are.