Comprehensive Framework for Security

Operations Center Analysis and

Network Defense
The architectural integrity of a modern Security Operations Center (SOC) is predicated upon a
foundational mastery of network communication, protocol analysis, and the systematic
interpretation of digital artifacts. A SOC analyst serves as the primary line of defense, tasked
with the continuous assessment of organizational IT infrastructure to identify weaknesses and
implement countermeasures against evolving cyber threats.1 This professional responsibility
necessitates an exhaustive understanding of how data moves across both private and public
networks, the specific mechanisms of the protocols governing that movement, and the myriad
ways in which malicious actors attempt to subvert these systems for unauthorized access or
disruption.1

Architectural Foundations of Network

Communication
At the most fundamental level, a network represents a collection of interconnected devices—
including computers, servers, and specialized hardware—designed to facilitate the sharing of
data and resources.3 These environments are broadly categorized into private networks, which
are internal to an organization, and public networks, most notably the Internet, which serves as
the global connective tissue for these disparate private entities.3 For communication to occur
within this ecosystem, every device must be uniquely identifiable, a requirement met through
two primary identification systems: physical hardware addresses and logical network
addresses.3

Physical and Logical Identification Systems

Identification on a network mirrors human identification through the use of permanent
"fingerprints" and temporary "names".3 The Media Access Control (MAC) address serves as the
hardware's permanent serial number, a twelve-character hexadecimal identifier assigned at
the point of manufacture.3 This address operates at the Data Link Layer (Layer 2) of the Open
Systems Interconnection (OSI) model and is essential for delivering data packets to the correct
physical device within a local area network (LAN).3 The MAC address is structured as six pairs
of characters, such as a4:c3:f0:85:ac:2d, where the first six characters represent the
Organizationally Unique Identifier (OUI) of the manufacturer, and the final six are a unique
serial number assigned to the specific network interface.3
Conversely, the Internet Protocol (IP) address functions as a logical, permeable identifier that
allows a host to be located within the broader network architecture for a period of time.3 While
MAC addresses are hardcoded and persistent, IP addresses are dynamic and can be
reassigned to different devices.3 This fluidity is a critical consideration for SOC analysts; an IP
address that was associated with a malicious event ten minutes ago may now be assigned to a
benign workstation, necessitating the use of DHCP (Dynamic Host Configuration Protocol)
logs and MAC address correlation to achieve accurate attribution.3

Identification Technical OSI Layer Persistence Administrative

Type Structure Scope

MAC Address 12-char Layer 2 (Data Persistent Local Area

Hexadecimal Link) (Hardcoded) Network (LAN)

IPv4 Address 32-bit (Four Layer 3 Dynamic/Static Local or Global

octets) (Network) (Public)

IPv6 Address 128-bit Layer 3 Dynamic/Static Global (Unlimited)

Hexadecimal (Network)

The distinction between public and private IP addresses is critical for SOC analysts monitoring
traffic ingress and egress. Private IP addresses (defined under RFC 1918) are utilized for
internal communication within a local network, whereas public IP addresses are assigned by
Internet Service Providers (ISPs) to identify the gateway to the internet.3 Data transmitted from
multiple devices within a private network often shares a single public IP address when reaching
the global internet via Network Address Translation (NAT).3

The Evolution of Internet Protocol Versions

The transition from IPv4 to IPv6 was necessitated by the exhaustion of the 32-bit addressing

space provided by the former.3 While IPv4 provides approximately or 4,294,967,296 unique
addresses, the rapid expansion of connected devices rendered this insufficient.3 IPv6 utilizes a

128-bit system, offering approximately or 340 undecillion unique addresses, while also
introducing improved efficiency and security features.3 Analysts must be proficient in
interpreting both dotted-decimal IPv4 notation (e.g., [Link]) and the colon-separated
hexadecimal notation of IPv6 (e.g., 2a00:22c4:531:425f:cce6:c36b:f64d).3

The mathematical foundation of IP addressing involves octet calculation. In IPv4, each of the
four octets is an 8-bit number, ranging from 0 to 255. The total IP address is the sum of these
bit values:

This numerical structure is further divided through subnetting, a technique used to organize
traffic and improve security by limiting the broadcast domain.2 For an analyst, understanding
subnet masks (e.g., /24) is vital for identifying whether two communicating IPs are on the same
local segment or if traffic must traverse a router, which provides a natural point for logging and
inspection.2

The OSI Model as a Diagnostic and Defensive

Framework
The Open Systems Interconnection (OSI) model, developed by the ISO in 1984, provides the
conceptual framework necessary for understanding how different networking protocols
interact.2 For a SOC analyst, the OSI model is not merely a theoretical construct but a
diagnostic tool used to isolate where an attack is occurring and which defenses are most
appropriate for mitigation.3

Layer 1 and Layer 2: The Physical and Data Link Foundations

The Physical Layer (Layer 1) manages the transmission of raw bitstreams over physical media,
such as copper cabling, fiber optics, or wireless signals.2 While often overlooked, it is the root
of availability; a severed fiber optic line or a jammed wireless signal represents a Physical Layer
denial-of-service (DoS).3 It defines voltage levels, data rates, and physical connectors,
ensuring proper synchronization between the sender and receiver.3

The Data Link Layer (Layer 2) organizes raw bits into structured units called frames and
ensures reliable point-to-point communication.3 It is divided into the Logical Link Control (LLC)
sublayer, which manages error detection and flow control, and the Media Access Control
(MAC) sublayer, which manages hardware addressing and medium access.3 Layer 2 is
frequently described as a "weak link" in network security due to the inherent trust protocols
like the Address Resolution Protocol (ARP) place in unauthenticated broadcasts.6 Switches
maintain Content Addressable Memory (CAM) tables to map MAC addresses to specific
physical ports.6 Attackers exploit these mechanisms through CAM table overflow attacks,
flooding the switch with invalid MAC addresses until the table is full, forcing the switch to fail-
open into a "hub" mode where it broadcasts all incoming traffic to all ports.6

Layer 3 and Layer 4: Routing and Transport Security

The Network Layer (Layer 3) is responsible for routing data packets across different network
segments using logical addresses, primarily IP addresses.2 Routers operate at this layer,
utilizing routing tables to determine the most efficient path across multiple networks.3
Common vulnerabilities at Layer 3 include IP spoofing, where an attacker forges the source IP
address to bypass access controls or launch reflection attacks, and ICMP-based attacks such
as Ping Floods.6 The connectionless nature of IP means it makes no effort to validate the
source of a packet, creating a persistent vector for identity forgery.7

The Transport Layer (Layer 4) provides end-to-end communication services, including

segmentation, reassembly, and flow control.3 It ensures that data is delivered accurately and at
a speed the receiver can process.3 The two primary protocols at this layer are the Transmission
Control Protocol (TCP) and the User Datagram Protocol (UDP).2 TCP is connection-oriented,
providing reliable delivery through a three-way handshake and sequence numbers, whereas
UDP is connectionless and prioritizes speed over reliability.2 SOC analysts monitor this layer for
anomalies such as SYN floods, which exploit the TCP handshake to exhaust server resources.8

Layers 5 through 7: The Application and Session Framework

The upper layers handle the presentation and application of data. The Session Layer (Layer 5)
establishes, maintains, and synchronizes communication sessions between two applications.3
This ensures that video and audio streams in a conference remain synchronized and that data
exchange follows a structure to prevent conflicts.3 The Presentation Layer (Layer 6) acts as a
translator, handling data encryption (e.g., SSL/TLS), compression, and formatting to ensure the
Application Layer can interpret the data.2

The Application Layer (Layer 7) is the topmost layer, providing network services directly to
end-user software.3 Protocols such as HTTP, FTP, SMTP, and DNS operate here.2 Attacks at
Layer 7 are particularly insidious because they often mimic legitimate user traffic.3 HTTP floods,
SQL injection, and Cross-Site Scripting (XSS) are common Application Layer threats that
require deep packet inspection (DPI) and Web Application Firewalls (WAF) for effective
mitigation.3

OSI Layer Name Unit Primary Key Security

 Protocol Concern

7 Application Data HTTP, DNS, Application logic

SMTP exploits, Phishing

6 Presentation Data SSL/TLS, JPEG Encryption bypass,

Malformed data

5 Session Data NetBIOS, RPC Session hijacking,

Authorization

4 Transport Segment TCP, UDP Connection

exhaustion, Port
scans

3 Network Packet IP, ICMP, IPsec IP Spoofing,

Routing
manipulation

2 Data Link Frame Ethernet, ARP ARP Poisoning,

MAC Spoofing

1 Physical Bit Fiber, 802.11 Physical

tampering, Signal
 jamming

Deep Dive into the TCP/IP Protocol Suite

While the OSI model is an essential reference, the TCP/IP model is the practical implementation
governing the internet.2 It consolidates the seven OSI layers into four: the Network Access
Layer, the Internet Layer, the Transport Layer, and the Application Layer.2

The Mechanics of Transmission Control Protocol (TCP)

TCP is designed for reliability. It utilizes a three-way handshake to establish a connection:

1. SYN: The client sends a packet with the Synchronize flag set and an initial sequence
number.
2. SYN-ACK: The server responds with a packet having both SYN and Acknowledgment
flags set, along with its own sequence number.
3. ACK: The client sends a final acknowledgment to confirm the connection.9

Each packet in a TCP session is assigned a sequence number, which is incremented based on
the amount of data sent.3 This allows the receiver to reorder packets that arrive out of
sequence and request retransmission of any that are lost.3 For a SOC analyst, predicting or
intercepting sequence numbers is a hallmark of session hijacking attacks.6 Furthermore,
analyzing TCP flags—SYN, ACK, RST (Reset), FIN (Finish), PSH (Push), and URG (Urgent)—is
essential for identifying reconnaissance. For example, a "SYN Scan" (or Half-Open scan)
involves sending a SYN packet but never completing the handshake with an ACK, allowing an
attacker to identify open ports without establishing a full connection log.9

Internet Protocol (IP) and ICMP Dynamics

The Internet Protocol (IP) handles the addressing and routing of packets across the internet.3 It
is inherently connectionless and "best-effort," meaning it does not guarantee delivery; this
responsibility is offloaded to TCP at Layer 4.3 A significant security weakness of IP is its lack of
source validation, enabling IP spoofing.6 Attackers can forge the source IP header to appear as
a trusted host within a local network, a technique often combined with TCP sequence number
prediction to bypass authentication.6

The Internet Control Message Protocol (ICMP) is used for network diagnostics.3 The ping tool
uses ICMP Echo Requests and Replies to measure round-trip time and connectivity.3 However,
ICMP is frequently misused. ICMP tunneling involves hiding non-diagnostic data within the
payload of an ICMP packet, allowing attackers to exfiltrate data through firewalls that permit
ICMP traffic but block standard data ports.12 Analysts monitor for unusual packet sizes or high
frequencies of ICMP traffic from a single source as indicators of this behavior.9

Essential Protocols and Port Management for the SOC

A critical skill for any SOC analyst is the immediate recognition of common port numbers and
the services they host, as well as the associated security risks.4 Misconfigured or unpatched
services running on these ports are often the primary entry point for major breaches.15

Foundational Services: FTP, SSH, and Telnet

Traditional protocols for file transfer and remote access vary significantly in their security
posture. The File Transfer Protocol (FTP), operating on ports 20 (Data) and 21 (Control), is
inherently insecure because it transmits credentials and data in cleartext.4 Telnet (port 23) is
similarly vulnerable and is largely deprecated in favor of Secure Shell (SSH).13

SSH (port 22) provides an encrypted channel for remote administration and file transfer.13
Despite its encryption, Port 22 is one of the most frequently attacked ports globally.18
Attackers use automated tools to launch brute-force and dictionary attacks, exploiting
systems that use weak default credentials or outdated software versions.4 SOC analysts must
enforce the use of key-based authentication and monitor for large volumes of failed login
attempts on this port.4

Web and Directory Services: HTTP, DNS, and SMB

Web traffic is predominantly handled by HTTP (port 80) and HTTPS (port 443). While HTTPS
uses SSL/TLS to encrypt data, it remains susceptible to SSL stripping or MiTM attacks if
certificates are not properly validated.4 The Domain Name System (DNS), operating on port 53,
is essential for translating hostnames to IP addresses but is frequently abused for DNS
spoofing, cache poisoning, and tunneling.4 Analysts monitor DNS logs for unusually long
subdomains or high volumes of TXT and NULL records, which are common indicators of data
exfiltration.4

The Server Message Block (SMB) protocol (port 445) is a high-risk area for Windows
environments. Historically, vulnerabilities like EternalBlue have allowed for widespread
ransomware propagation (e.g., WannaCry) by exploiting unpatched SMB implementations.4
SOC analysts must ensure SMBv1 is disabled and that SMB signing is enforced to prevent
NTLM relay attacks.4

Port Service Risk Factor SOC Monitoring

 Strategy

21 FTP Cleartext credentials Monitor for anonymous

login & large transfers

22 SSH Brute-force attacks Alert on 10+ failed

logins in 5 minutes

25 SMTP Phishing, Open relays Monitor outbound mail

volume & SPF/DKIM

53 DNS Data exfiltration Analyze subdomain

length & record types

80 HTTP Unencrypted data Redirect to 443;

Inspect for SQLi/XSS

443 HTTPS Encrypted tunnels Monitor TLS version &

certificate validity

445 SMB Lateral movement Block at perimeter;

monitor for EternalBlue
3389 RDP Credential stuffing Restrict to VPN; require
MFA

Network Traffic Analysis and Detection

Methodologies
A core competency of a SOC analyst is the ability to perform packet-level analysis to validate
alerts and uncover hidden threats.1 This requires proficiency with tools that capture, inspect,
and filter network traffic in real-time.21

Real-Time Traffic Capture and Inspection Tools

Tcpdump is a lightweight, command-line utility used for capturing network packets, often
favored in high-throughput environments for its efficiency and ubiquitous presence on Unix-
like systems.21 Analysts use it to capture raw data which can then be imported into more
feature-rich tools like Wireshark for deep-dive analysis.21

Wireshark is the industry-standard graphical protocol analyzer.21 It allows analysts to inspect

headers and payloads, follow TCP streams to reconstruct conversations, and apply granular
filters to isolate specific behaviors.9 For example, to detect a TCP Connect scan, an analyst
might use the filter [Link]==1 and [Link]==0 and tcp.window_size > 1024.10 This
filter specifically targets SYN packets that initiate a connection attempt but are distinctive
from other scan types by their window size.10

Signature-Based and Behavioral Detection Systems

Intrusion Detection Systems (IDS) such as Snort and Suricata provide automated monitoring by
matching real-time traffic against a database of known attack signatures.21 These tools are
essential for flagging known malware C2 patterns or exploit attempts like Log4j.10 However,
signature-based detection is limited by its inability to identify zero-day threats or highly
customized attacks.

To address this, behavioral analysis tools like Zeek (formerly Bro) focus on identifying patterns
in traffic flows and metadata rather than individual packets.21 Zeek is particularly effective for
identifying DNS tunneling or unusual HTTP request patterns that indicate reconnaissance.21
Frameworks like RITA (Real Intelligence Threat Analytics) can then ingest these logs to detect
command-and-control beacons by analyzing the heartbeat-like timing of connections to
external IPs.21
Host-Based Monitoring and Endpoint Detection
While network visibility is crucial, the ultimate objective of most attacks is the compromise of
an endpoint.2 SOC analysts must therefore balance their network analysis with host-based
detection strategies.1

Windows and Linux Logging Architecture

In Windows environments, the Security Event Log is the primary source of evidence.21 Analysts
track specific Event IDs to reconstruct an attacker's timeline. For instance, ID 4624 indicates a
successful logon, whereas ID 4688 records the creation of a new process.21 Sysmon (System
Monitor) provides even deeper telemetry, including process parent-child relationships and file
creation times, which are vital for detecting "living-off-the-land" attacks where an adversary
uses legitimate system tools like PowerShell for malicious purposes.21

On Linux systems, analysts rely on logs found in /var/log/, such as [Link] for authentication
attempts and syslog for general system messages.1 Understanding the command line and
being able to grep through these logs for anomalous activity is a fundamental skill for
investigating Linux-based server compromises.1

Windows Event ID Description Threat Indicator

4624 Account Logged On Lateral movement, account

takeover

4688 Process Created Malware execution, script

running

4720 User Account Created Persistence through new

admin accounts
4732 Local Group Member Added Privilege escalation

4672 Special Privileges Assigned Administrative abuse

1102 Audit Log Cleared Anti-forensics / Cover-up

Endpoint Detection and Response (EDR) and Forensics

Modern SOCs increasingly rely on Endpoint Detection and Response (EDR) platforms like
CrowdStrike or Microsoft Defender for Endpoint.1 These tools provide real-time visibility into
host activity and allow analysts to perform remote triage, such as isolating an infected
workstation from the network or terminating a malicious process.23

For deep-dive investigations, analysts utilize forensics tools. Memory analysis tools like
Volatility and Rekall allow for the extraction of running processes, loaded drivers, and open
files from a memory dump, which is critical for detecting fileless malware that never touches
the disk.21 Disk imaging tools like FTK Imager create forensically sound replicas of storage
media, enabling analysts to carve out deleted files or examine registry hives without altering
the original evidence.21

Incident Response Frameworks and SOC Workflows

The effectiveness of a SOC is measured by its ability to rapidly detect, analyze, and contain
threats.1 This process is governed by structured workflows and incident response (IR)
frameworks.2

The Lifecycle of an Incident

A typical SOC workflow follows several key phases:

1. Detection: Monitoring alerts generated by SIEM (Security Information and Event

Management) tools like Splunk or Microsoft Sentinel.1
2. Triage and Analysis: Categorizing alerts as true or false positives and determining the
severity of the threat.2 Analysts investigate logs, network traffic, and system behavior to
find the root cause.2
 3. Containment: Taking immediate steps to prevent the spread of an attack, such as
isolating affected systems or blocking malicious traffic.2
4. Eradication and Recovery: Removing the threat through cleaning, patching, or
restoration from backups, and returning systems to normal operation.2
5. Post-Incident Review: Documenting the incident and recommending improvements to
prevent future occurrences.2

Operational Tiering and the Impact of Automation

Traditional SOCs operate in a tiered structure. Tier 1 analysts handle high-volume alert triage;
Tier 2 analysts perform deeper investigations and containment; Tier 3 analysts (threat hunters)
focus on complex forensics and proactive detection engineering.24 However, the rise of AI and
Security Orchestration, Automation, and Response (SOAR) platforms is flattening these tiers.1
Agentic AI can now autonomously investigate common alerts, allowing human analysts to
focus on high-impact specialization roles such as investigation specialists or detection
engineers.26

Analytical Frameworks for Adversary Tracking

To provide context to their investigations, SOC analysts utilize industry-standard frameworks
that map out the "how" and "why" of an attack.2

The Cyber Kill Chain and Unified Kill Chain

Developed by Lockheed Martin, the Cyber Kill Chain describes the stages of a cyberattack:
Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control
(C2), and Actions on Objectives.2 By identifying where an attacker is in this lifecycle, analysts
can implement more effective blocking strategies.2 For example, blocking a malicious email
during the "Delivery" phase prevents the subsequent exploitation and installation stages.2

The MITRE ATT&CK Framework

The MITRE ATT&CK framework provides a comprehensive knowledge base of adversary
behavior.1 It allows analysts to categorize suspicious activity into specific tactics (e.g.,
Persistence, Privilege Escalation) and techniques (e.g., Phishing, Kerberoasting).1 Mapping
alerts to MITRE ATT&CK helps the SOC identify coverage gaps in their detection logic and
communicate threat levels to stakeholders effectively.24

Professional Competency and Certification Pathways

The role of a SOC analyst requires a blend of technical expertise, analytical intuition, and strong
communication skills.1 Developing these skills often involves a combination of hands-on
experience and standardized certifications.1
Key Technical and Analytical Skills
Beyond networking and protocol analysis, a professional analyst should possess:

● Log Management: Proficiency in SIEM query languages like SPL or KQL to search and
correlate data.24
● Scripting and Programming: Basic knowledge of Python, PowerShell, or SQL to
automate routine tasks and query databases.1
● Critical Thinking: The ability to form hypotheses, gather evidence, and reach logical
conclusions during an investigation.5
● Documentation: Clear and concise writing is essential for creating incident reports and
maintaining playbooks.2

Industry-Recognized Certifications
Certifications serve as a signal of standardized capability to employers.

● CompTIA Security+: The foundational entry-level certification covering baseline

security concepts.1
● CompTIA CySA+: Targets the specific skills needed for threat detection and incident
response.23
● Blue Team Level 1 (BTL1): A practical, hands-on certification that requires candidates to
perform actual investigation and analysis tasks.23
● Certified Ethical Hacker (C|EH): Provides the offensive perspective necessary for
analysts to understand adversary techniques.1

Synthesis and Strategic Recommendations for the

Modern Analyst
The role of the SOC analyst is undergoing a fundamental shift from reactive alert monitoring to
proactive threat management. This transition is driven by the increasing complexity of network
environments—including hybrid cloud architectures and the proliferation of IoT devices—and
the sophistication of adversaries who utilize AI and automated exploits.

To remain effective, analysts must move beyond simple packet inspection and begin
identifying real patterns an analyst would encounter in early-stage reconnaissance and
suspicious network activity.10 This requires a deep curiosity about how systems interact at the
protocol level and a commitment to continuous learning. The integration of AI tools into the
SOC does not replace the human analyst but rather expands their capabilities, allowing them
to focus on the nuances of detection engineering and high-level incident coordination.5 By
mastering the foundational principles of networking, maintaining a sharp analytical edge
through constant practice with tools like Wireshark and SIEM platforms, and grounding their
investigations in structured frameworks like MITRE ATT&CK, analysts provide the resilient
defense necessary to protect organizational assets in a pervasively digital world.2

The evolution of the SOC from a reactive "command center" to a proactive defense hub
necessitates that the analyst becomes a multidisciplinary expert. The future of security
operations lies in the ability to bridge the gap between technical data points and business
impact, ensuring that every alert is not just closed, but contributes to a more robust and
resilient organizational security posture. Continuing education, hands-on labs, and a rigorous
adherence to investigative methodologies like the SANS FOR508 are no longer optional—they
are the prerequisite for professional success in the high-stakes environment of modern
cybersecurity.2

Works cited

1. SOC Analyst: Career Path Overview | Cybrary, accessed April 30, 2026,
[Link]
2. SOC Analyst Course Syllabus & Career Guidance - SOC Masters, accessed April
30, 2026, [Link]
3. SOC Analyst [Link]
4. Common Ports Cheat Sheet: The Ultimate List - StationX, accessed April 30,
2026, [Link]
5. Become A SOC Analyst With EC-Council, accessed April 30, 2026,
[Link]
6. Network Attacks (Layer 2 and Layer 3) Chun-Jen (James) Chung Arizona State
University, accessed April 30, 2026,
[Link]
media=classlog:computernetworksecurity:12-network_attacks-[Link]
7. Layer 2 Network Vulnerabilities & Mitigation | PDF | Denial Of Service Attack -
Scribd, accessed April 30, 2026,
[Link]
Short-Note
8. TCP/IP In Cyber Security: What Does It Mean? - Ftp, accessed April 30, 2026,
[Link]
1767647835
9. SOC Lab 1 - Detecting network scans, brute-force attacks, and malware traffic
using Wireshark - Kodeesh, accessed April 30, 2026,
[Link]
brute-force-attacks-and-malware-using-wireshark-7e282d3c692c
10. Wireshark Traffic Analysis — A Complete Walkthrough (TryHackMe Room) | by
Mohamed Fathy Kamel | Medium, accessed April 30, 2026,
[Link]
complete-tryhackme-walkthrough-11fd4cf82eb5
11. A walk-through of the TCP handshake - Command Line Fanatic, accessed April
 30, 2026, [Link]
12. accessed January 1, 1970, [Link]
is-icmp-tunneling
13. Top 50 Ports for SOC Analysts' Risks | PDF | Transport Layer Security - Scribd,
accessed April 30, 2026, [Link]
Well-Known-Ports-for-SOC-Analysts-1717208197
14. Understanding Network Ports in Cybersecurity: A SOC Analyst's Guide with Kali
Linux, accessed April 30, 2026,
[Link]
cybersecurity-a-soc-analysts-guide-with-kali-linux-dd6f7cfcf2bb
15. Mastering the Top 25 Ports: An In-Depth Guide to Configuration and Security,
accessed April 30, 2026, [Link]
an-in-depth-guide-to-configuration-and-security/
16. Common Network Ports & Protocols - A Cybersecurity Attack Surface Guide -
Isosecu, accessed April 30, 2026, [Link]
ports-and-protocols
17. 14 common network ports you should know | [Link], accessed April
30, 2026, [Link]
18. What are common ports used by attackers? - Inventive HQ, accessed April 30,
2026, [Link]
19. DNS Tunnelling, Exfiltration and Detection over Cloud Environments - PMC,
accessed April 30, 2026, [Link]
20. How SOC Analysts Actually Investigate Network Traffic (Wireshark Walkthrough)
- YouTube, accessed April 30, 2026, [Link]
v=xl56QIsMoTQ
21. SOC Tools Every Analyst Should Know - TCM Security, accessed April 30, 2026,
[Link]
22. SOC Level 1 - TryHackMe, accessed April 30, 2026,
[Link]
23. How to Become a SOC Analyst in 2026 | Unihackers, accessed April 30, 2026,
[Link]
24. SOC Analyst Level 1 Training | Entry-Level Cybersecurity Course - BlueCyber,
accessed April 30, 2026, [Link]
25. Security Operations Analyst Level 1 | Cisco U. Path, accessed April 30, 2026,
[Link]
26. SOC Tiers Explained: What Tier 1, 2, and 3 Analysts Do (and How AI Is Changing
Each Role) | Prophet Security, accessed April 30, 2026,
[Link]
tier-1-2-3
27. Top 5 SOC Analyst Certifications for 2024 - TCM Security, accessed April 30,
2026, [Link]