CYBERPULSE ACADEMY · SOC BLUE TEAM

The Pulse: SOC Analyst Handbook and Investigation Practice

A practical, plain-language guide to working as a security operations center (SOC) analyst, with eight theory chapters, practice tests and 60 interactive investigations. Built by Sacyra Education for the CyberPulse Academy app.

See the curriculum →Preview the investigations

SACYRA EDUCATION

What is a SOC analyst's job?

A security operations center watches an organization's systems for signs of attack. Tools such as a SIEM, endpoint detection and email security gather events and raise alerts. The analyst's job is to decide, quickly and with evidence, whether each alert is a real incident (a true positive) or harmless activity (a false positive), and then to contain, escalate and document what is real.

Most alerts are not attacks. The skill is not memorizing tools; it is asking the right next question, checking history, understanding which assets and people matter most, and writing a note that a colleague on the next shift can act on.

The tiers, in brief

Level	Typical focus
L1 analyst	Monitors the queue, triages alerts, enriches evidence, closes false positives, escalates the rest with a clear note.
L2 analyst	Deeper investigation, containment actions, scoping across hosts and accounts, and tuning noisy detections.
L3 / hunter / IR lead	Threat hunting, malware and forensic analysis, incident command, detection engineering and lessons learned.

The seven-step investigation workflow

Every scenario in The Pulse follows the same loop, so the habit becomes automatic.

1Alert

Read what fired, on which asset or account, and why. Note the source, the time and what the rule is meant to catch.

2Triage

Choose the best first step. Usually that means gathering the evidence that separates a real attack from a benign cause, not acting on the headline.

3Evidence

Pull logs, headers, process trees, sign-in history and asset context. Look back 30 to 90 days to see whether this behavior is new for the user or system.

4Verdict

Decide: true positive, false positive, or genuinely unclear and needs escalation. Then say which evidence supports it.

5Contain

Order the response actions: stop the harm first, preserve evidence, remove access, then restore and improve.

6Severity

Rate the impact from P4 (low) to P1 (critical) using what was actually affected, not how dramatic the alert looks.

7Document

Write the ticket note and the incident summary: what happened, what was affected, what you did and the current status. Facts, no blame.

The curriculum: eight chapters

Each chapter ends with a practice test. Lessons mix concepts, annotated examples, checklists and common mistakes, with MITRE ATT&CK references where they help.

1SOC Fundamentals

What a SOC is, the seven-step investigation workflow, severity, documentation, root cause analysis and incident communication.

What a SOC Actually Is
The Investigation Workflow
Classifying Incident Severity
Documentation Discipline
Root Cause Analysis
Communicating an Incident

2Logs, SIEM & Detection

Where alerts come from, how a SIEM works, reading logs, MITRE ATT&CK in daily work, and writing and tuning detections.

Where Alerts Come From: Logs and Telemetry
How a SIEM Works
Reading Logs Like an Analyst
Threat Intelligence and MITRE ATT&CK
Writing and Tuning Detections

3Email & Phishing Analysis

Reading message headers, links and attachments, OSINT and sandboxes, contemporary phishing attacks, response and defenses.

Anatomy of an Email: Reading the Headers
Links, Attachments and QR Codes
Phishing Types and What the Attacker Wants
Phishing Today: Contemporary Attacks
The Phishing Response Workflow
Email Defenses and Reducing the Risk

4Endpoint & Malware Triage

Host telemetry, process trees, PowerShell and LOLBins, persistence, credential access, ransomware precursors and malware triage.

Endpoint Telemetry: What Hosts Tell You
Process Trees and Parent-Child Relationships
PowerShell, LOLBins and Persistence
Credential Access and Ransomware Precursors
Malware Triage Basics
Endpoint Investigation Workflow and Evidence

5Network & Traffic Analysis

DNS, HTTP and TLS, firewall, proxy and flow logs, beaconing, scanning, tunneling, packet captures and false positives.

Network Fundamentals for Analysts
Network Log Sources: Firewall, Proxy, DNS, NetFlow and IDS
Spotting Beaconing, Scanning and Tunneling
Reading Packet Captures: Wireshark, Zeek and Suricata
Network Investigation Workflow and False Positives

6Identity, Cloud & SaaS Investigations

Sign-in logs, MFA and token theft, device code and OAuth abuse, Active Directory attacks, cloud control-plane logs and mailbox investigations.

Identity as the New Perimeter: Sign-In Logs, MFA and Conditional Access
Token Theft, AiTM, Device Code and OAuth Consent Abuse
Active Directory Attacks at Analyst Level
Cloud Control-Plane Logs, Misconfigurations and Exposed Keys
SaaS and Mailbox Investigations
A Cloud Investigation Workflow and Habits of a Good Analyst

7Incident Response & Containment

The IR lifecycle, escalation, containment trade-offs, evidence preservation, ransomware and BEC playbooks, and post-incident reviews.

The Incident Response Lifecycle
Severity, Escalation and Communication
Containment Decisions and Business Impact
Evidence Preservation and Chain of Custody
Playbooks: Ransomware and Business Email Compromise
Post-Incident Reviews and Writing a Good RCA

8Threat Intel, Hunting & SOC Operations

IOCs and TTPs, enrichment and sharing, hypothesis-driven hunting, detection engineering, SOC metrics, automation and career growth.

Threat Intelligence for Analysts: IOCs, TTPs and Confidence
Working with Intel: Enrichment, MISP, OpenCTI and TLP
Hypothesis-Driven Threat Hunting
Detection Engineering and Tuning
SOC Metrics, Shifts, Queues and Automation
Career Growth: From L1 to L2, L3 and Beyond

Investigation Practice: 60 scenarios

Work a realistic alert from first notification to final report. Scenarios are fictional, written to teach one transferable lesson each, and a good share of them are false positives or genuinely ambiguous, because real queues are like that.

What to expect in a scenario

Limited evidence: some cases give you a budget, so you must choose which logs to open first.
Spot the signs: pick out the suspicious lines in headers, commands or logs, avoiding the normal ones.
Timeline and containment: put events and response actions in the right order.
Severity and report: rate the impact and pick the ticket note a colleague could act on.

How access works: the theory chapters are open to all users. Investigation Practice unlocks after you pass the Final Certification Exam (75% or higher); until then the app shows a preview of what to expect. Pulse AI is switched off during investigations so the work is your own.

Email & Social Engineering (10)

Phishing Email Reported by a UserSuspicious Mailbox Forwarding RuleQR Code on the Lobby PosterThe Supplier Who Changed BanksThe Invoice That Asked for a Phone CallThe CAPTCHA That Wanted You to Press Win+R1,900 Emails and a Friendly VoicePlease Update My Bank DetailsA Reply on an Old ThreadThe Newsletter Everyone Reported

Identity & Access (10)

MFA Push Fatigue AttackUnauthorised Privilege ElevationImpossible Travel Sign-inService Account Logs In InteractivelyFour Hundred Doors, One PasswordThe Helpful App That Asked for EverythingA Code Typed Into the Wrong PageHundreds of Service Tickets in One MinuteA New Global Administrator AppearsThe Emergency Account Was Used

Endpoint & Malware (9)

Lateral Movement with PsExecRansomware: Mass File EncryptionThe Invoice That Asked to Enable ContentEncoded PowerShell on a Sunday NightA Built-in Tool Doing a Strange JobSomeone Is Reading the Server's Memory of PasswordsA New Task With a Familiar NameThe Free Editor That Took Every Saved LoginEDR Alert: Hacktool on the Jump Host

Network Security (6)

Port Scan from an Internal HostThe Server With a Very Long VocabularyHeartbeat From the Domain ControllerThe Router Nobody InstalledThe Port Scan That Had a Permission SlipA Certificate That Does Not Quite Add Up

Cloud Security (3)

Cloud Storage Bucket Open to EveryoneA Key Pushed to a Public RepositoryBackups Deleted, A Note Left Behind

Insider Risk (5)

The Notice Period DownloadThe Unlisted Flash DriveThe Admin Who Read the Boss's MailA Full Database Dump at MidnightBadge In, Log On, Nobody Home

Data Loss Prevention (4)

DLP Alert: Bulk Data UploadNine Hundred Gigabytes Out of the DoorThe Free Tool Nobody ApprovedRight Name, Wrong Recipient

Web Application Security (5)

A Picture That Ran CommandsA Token in a Forked RepositoryWAF Alert: SQL Injection BurstScan Storm From an Unknown AddressA Fresh Exploit Against the VPN Gateway

Supply Chain (2)

A Build Pipeline That Pushed Something UnexpectedThe Package With a Familiar Name

AI & LLM Security (6)

The CEO Who Called About a WireCustomer Data Pasted into a Public AI ChatThe Support Bot That Followed a Hidden OrderThe Agent With Too Many KeysA Surprise 31,000 AI BillThe Assistant That Read the Wrong Folder

Core skills the handbook builds

Reading evidence in context

An alert is a claim, not a conclusion. A PowerShell command might be an attacker or a patching script; a large upload might be theft or a migration. The handbook teaches you to check who owns the asset, how critical it is, what the account normally does, and what happened in the previous 30 to 90 days before deciding.

Email and phishing

Read headers from the Authentication-Results line and the first external hop, compare From, Return-Path and Reply-To, treat links and attachments safely with OSINT lookups and sandboxes, and recognise current techniques such as QR codes in documents, ClickFix and device code phishing.

Endpoint and malware

Follow parent-child process relationships, recognise living-off-the-land binaries, find persistence, and notice the precursors to credential theft and ransomware. Triage a sample using hashes, strings and sandbox reports without running it on a work machine.

Network traffic

Use DNS, proxy, firewall, flow and packet data to spot beaconing, scanning, tunneling and exfiltration, and learn which noisy patterns are normal for scanners and CDNs.

Identity and cloud

Treat identity as the new perimeter: read sign-in logs, understand token theft and OAuth consent abuse, spot Kerberoasting, and read cloud control-plane logs for exposed keys and risky changes.

Containment and communication

Balance stopping an attacker against keeping the business running, preserve evidence, and communicate in plain language to people who are not analysts.

Tools you will meet, by category

The handbook is tool-neutral. It teaches the questions each category answers, and mentions free options so you can practice at home. Check each project's site for current availability and terms.

Category	What it answers	Examples to explore
SIEM and log search	What happened, where, and when?	Commercial and open-source SIEMs; Elastic stack, Wazuh
Endpoint detection (EDR)	What ran on the host and what started it?	Sysmon, osquery, Velociraptor
Network analysis	Who talked to whom, and what did they say?	Wireshark, Zeek, Suricata
Email analysis	Is this message genuine?	Header analyzers, URL and file sandboxes, mail gateway logs
Threat intelligence	Have others seen this indicator or technique?	MISP, OpenCTI, MITRE ATT&CK
Malware triage	What does this file do?	YARA, CyberChef, open-source sandboxes
Case management and SOAR	How do we track and automate response?	TheHive, ticketing systems, playbook automation

SOC glossary

Term	Meaning
True positive	An alert that correctly identifies real malicious or unauthorized activity.
False positive	An alert that fired on harmless activity.
IOC	Indicator of compromise: an observable such as an IP address, domain or file hash.
TTP	Tactics, techniques and procedures: how an attacker behaves, which is harder to change than an IOC.
SIEM	Security information and event management: a platform that collects, searches and correlates logs.
EDR	Endpoint detection and response: software that records host activity and can contain a device.
MITRE ATT&CK	A public knowledge base of attacker tactics and techniques used to describe and map behavior.
Triage	Quickly deciding how urgent and how likely real an alert is.
Containment	Actions that stop an incident spreading, such as isolating a host or disabling an account.
Lateral movement	An attacker moving from one system to another inside a network.
Beaconing	Regular, repeated outbound connections that suggest malware checking in with its controller.
BEC	Business email compromise: fraud using email impersonation or a hijacked mailbox, often to redirect payments.
MFA fatigue	Repeated approval prompts sent to wear a user down until they accept one.
SOAR	Security orchestration, automation and response: tooling that automates parts of the response.
RCA	Root cause analysis: finding the underlying reason an incident happened.
Chain of custody	A record of who handled evidence and when, so it can be trusted.

FREQUENTLY ASKED QUESTIONS

What is The Pulse?

The Pulse is the SOC Blue Team module of CyberPulse Academy, the cybersecurity learning app from Sacyra Education. It combines eight theory chapters with practice tests and 60 hands-on investigation scenarios that follow a real security operations center workflow.

Who is The Pulse for?

Students, career changers and IT staff who want to become SOC analysts, and junior analysts who want structured practice. No prior SOC experience is needed; the first chapter starts from what a SOC actually is.

Is The Pulse available to everyone?

Yes. The Pulse and all of its theory chapters are open to every CyberPulse Academy user. The Investigation Practice scenarios unlock after you pass the Final Certification Exam (75% or higher), and the Investigation Practice section shows a preview of what to expect before then.

What do the investigation scenarios involve?

Each scenario walks through alert triage, evidence gathering, spotting the signs, a true-positive or false-positive verdict, a timeline, containment ordering, severity rating and a written summary. Some alerts are harmless or ambiguous, so you practice deciding, not just reacting.

Does Pulse AI help during investigations?

No. Pulse AI is switched off during investigations, practice tests and the certification exam so you work the case yourself. It is available while you read lessons.

Are the scenarios based on real incidents or real companies?

The scenarios use fictional organizations, people and data. Domains use the reserved .example name and IP addresses come from documentation ranges, so nothing points to a real system.

Get the app: CyberPulse Academy by Sacyra Education, launching soon on Android and iOS. Questions? See Support or read about Pulse AI, the in-app assistant.