SOC & Threat Intelligence

Complete Study Guide

Fundamentals of Cyber Defense & SOC Operations

CIA Triad · Threat Actors · Network Protocols · Logs · SOC Structure · Tools & KPIs
 1. Introduction to Cybersecurity & Cyber Defense

Cybersecurity = protecting digital systems, networks, apps and data from attacks, unauthorized access, disruption, or
destruction.
Cyber Defense = the ACTIVE, continuous practice of detecting, analyzing, responding to, and recovering from attacks. It
assumes attackers WILL get in and focuses on minimizing impact.

Cybersecurity Cyber Defense

Approach Preventive Active + Reactive

Focus Controls & policies Detection & response

Tools Firewalls, encryption, access control SOC, incident response, threat hunting

Goal "Stop attacks" "Detect, Respond, Recover"

5 Core Pillars of Cyber Defense:

• Visibility — Know what's happening in your network
• Monitoring — 24/7 log & traffic analysis
• Detection — Identify suspicious behaviour
• Response — Contain and neutralize attacks
• Recovery — Restore systems & prevent recurrence

2. CIA Triad — The 3 Pillars of Information Security

Pillar What It Means Threats How to Achieve It

■ Confidentiality Only authorized users can Unauthorized access, data leaks, Encryption (AES/TLS), MFA, access
access data weak passwords, insider misuse controls, VPN/HTTPS

■ Integrity Data remains accurate & Data tampering, MITM attacks, Hash functions (SHA-256), digital
unaltered during malware, unauthorized file changes signatures, checksums, file integrity
storage/transit monitoring

■ Availability Systems & data accessible DoS/DDoS attacks, hardware failures, Redundancy & backups, load
when needed by authorized ransomware, natural disasters balancing, disaster recovery planning
users

■ Risk Formula: Risk = Threat × Vulnerability × Impact | Integrity check: if even ONE bit changes, hash verification fails.
 3. Security Controls & 4. Threat Actors

Types of Security Controls:

Type Purpose Examples Analogy

Preventive Stop incidents BEFORE Firewalls, antivirus, encryption, access control, Lock on the door
they occur patch management

Detective IDENTIFY & ALERT when Log monitoring, SIEM alerts, IDS, network traffic Security camera
incident is happening analysis

Corrective Minimize damage & Incident response, malware removal, backup Calling police & repairing
RESTORE after incident recovery, patching damage

4. Threat Actors

Threat Actor Motivation Skill Level Typical Methods Real Example

Cybercriminals Financial gain High — organized Phishing, ransomware, fraud, Ransomware encrypts
crime malware company files → demands
Bitcoin

Nation-State Political/military Very High — APTs, zero-days, infrastructure APT28 (Fancy Bear) — linked
Hackers espionage govt-funded sabotage to Russia's GRU

Insider Threats Personal gain, Varies — has Data theft, sabotage, unauthorized Employee downloads sensitive
revenge, accident trusted access access files to personal device

Hacktivists Ideological/political Medium Website defacement, DDoS, data Hacktivist defaces govt website
protest leaks to expose corruption

Cyber Terrorists Fear, destruction, Varies Attacking hospitals, power grids, Ransomware cripples hospital,
extreme motives transport halts emergency services

Script Kiddies Fame, curiosity, Low — pre-built Automated DDoS, known exploits Teen runs DDoS script to knock
thrill tools gaming server offline

Term Definition Examples

Attack Surface Sum of ALL points in a system an attacker can Open ports, web apps, user accounts, endpoints, cloud
target resources

Attack Vector The METHOD/PATH used to gain access Phishing emails, exploiting vulnerabilities, malware,
credential stuffing, misconfigurations

Vulnerability A weakness that CAN be exploited (exists even Unpatched software, weak passwords, misconfigured
without attack) systems

Risk Potential damage when a threat EXPLOITS a Data breach, financial loss, downtime, reputational
vulnerability damage
 5. Network & OS Foundation

Over 90% of SOC alerts come from network traffic, OS logs, and endpoint telemetry. Without network knowledge,
you can't trace attacks, validate alerts, or detect lateral movement.

OSI Model — 7 Layers (SOC Relevance)

Layer Name What It Does SOC Tool / Log

7 Application User-facing protocols: HTTP, DNS, SMTP, FTP WAF, Proxy logs

6 Presentation Data format, encryption/decryption (TLS/SSL) TLS inspection

5 Session Session management between apps Session hijacking detection

4 Transport End-to-end delivery, TCP/UDP, port numbers Firewall port rules

3 Network Logical addressing, IP routing Firewall logs, IDS/IPS

2 Data Link Physical addressing (MAC), switches Switch/ARP logs

1 Physical Actual bits over cable/wireless Physical access logs

■ Memory tip: All People Seem To Need Data Processing (Application→Physical). L3→Firewall logs. L7→Proxy/WAF logs.

Key Network Concepts:

Concept Explanation

TCP vs UDP TCP = reliable, connection-based (3-way handshake: SYN→SYN-ACK→ACK). UDP = fast, no
handshake.

Well-known Ports 22=SSH, 80=HTTP, 443=HTTPS, 53=DNS, 25=SMTP, 3389=RDP, 445=SMB — abnormal port
usage = IOC!

Private IPs 10.x.x.x, 172.16.x.x, 192.168.x.x — not routable on internet. NAT translates to public IP.

CIDR/Subnetting [Link]/24 = 256 addresses. /24 = subnet mask [Link]

Beaconing Malware checking in with C2 server at regular intervals — look for periodic outbound connections
 6. Core Protocols: DNS · HTTP/S · SMTP · DHCP

■ DNS (Domain Name System) — The Internet's Phonebook

Translates domain names ([Link]) → IP addresses ([Link]). Every internet connection starts with
DNS.

Step What Happens

1 — User types URL Browser asks local DNS resolver (ISP/enterprise) to look up the domain

2 — Cache check If cached → returns IP immediately. If not → queries further.

3 — Root Server Directs resolver to the correct TLD server (.com, .org, .in etc.)

4 — TLD Server .com server points to the authoritative DNS server for that domain

5 — Authoritative Returns the actual IP (e.g., [Link]). Browser connects to it.

■■ Risk: DNS Cache Poisoning: Attacker injects false IP → [Link] points to attacker's server. Mitigation: DNSSEC
(cryptographic signatures on DNS records).

■ HTTP vs HTTPS
HTTP HTTPS

Data Sent in PLAINTEXT — anyone can intercept Encrypted via TLS/SSL — safe from eavesdropping

How it works Client sends request → server responds First: TLS handshake (certificate → verify → session
key) → THEN encrypted data

Risk Vulnerable to MITM, session hijacking, data theft Provides Confidentiality + Integrity + Authenticity

SOC note Login credentials visible in plain text Padlock icon in browser = certificate verified

■ SMTP (Email) — Ports 25/587

Sends email between mail servers. Flow: MUA → Sender's MTA → (DNS MX lookup) → Recipient's MTA → stored for
POP3/IMAP retrieval.

Security Extension Purpose

STARTTLS Encrypts SMTP traffic between servers

SPF Validates which IPs are authorized to send for a domain

DKIM Adds cryptographic signature to verify email authenticity

DMARC Aligns SPF/DKIM with domain policy to prevent email spoofing

■ DHCP — DORA Process (Auto IP Assignment)

Step What Happens

D — Discover Device broadcasts DHCPDISCOVER to [Link] asking for an IP

O — Offer DHCP server replies with: IP address, subnet mask, default gateway, DNS server, lease time

R — Request Device sends DHCPREQUEST confirming it accepts the offered IP

A — Acknowledge Server sends DHCPACK finalizing lease. Device is now online!

■■ Risk: Rogue DHCP Server: Attacker assigns malicious gateway/DNS, redirecting ALL traffic through their machine.
Mitigation: DHCP snooping on switches, 802.1X authentication.
 7. Windows Event Logs

Windows records everything in its Event Logs — centralized records of system, security, and application events. The
Security log is the most important for SOC.

Windows Log Types:

Log What It Records

Security Logins, logouts, access events, audit policy changes — MOST IMPORTANT

System OS events: drivers, services, hardware failures

Application App errors, crashes, info messages

Setup Windows installation and update events

Forwarded Events Logs collected from other machines for centralized monitoring

Critical Event IDs — MEMORIZE THESE:

Event ID What It Means SOC Significance

4624 Successful Logon Track logon type, source IP, account — baseline normal activity

4625 Failed Logon Multiple from same IP = brute force attack!

4688 Process Created New process started — catch malware execution

4697 Service Installed New service = possible attacker persistence mechanism

4720 User Account Created Unexpected new user = attacker creating backdoor account!

4732 User Added to Group Added to privileged group = possible privilege escalation

4776 NTLM Authentication Used in pass-the-hash attacks

Capturing Logs (PowerShell):

Task Command

Last 10 Security events Get-WinEvent -LogName Security -MaxEvents 10

All failed logins (4625) Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}

List all logs Get-WinEvent -ListLog *

GUI method Win+R → [Link] → Windows Logs → Security

Windows Authentication:
Concept Explanation

NTLM Older challenge-response auth. Vulnerable to pass-the-hash attacks.

Kerberos Ticket-based auth used in Active Directory. More secure than NTLM.

LSASS Handles all authentication. Attackers dump LSASS memory to steal credentials (mimikatz).
 8. Linux OS & Syslog Monitoring

Linux stores logs as plain text files under /var/log/. Modern systems also use systemd-journald, accessible via the
journalctl command.

Important Linux Log Files:

Log File Contains Distro

/var/log/[Link] SSH logins, sudo usage, failed login attempts Ubuntu/Debian

/var/log/secure Same as [Link] RHEL/CentOS

/var/log/syslog General system messages — catch-all Ubuntu/Debian

/var/log/messages General system activity, kernel messages RHEL/CentOS

/var/log/cron Cron job scheduling — check for malicious scheduled All

tasks

/var/log/apache2/[Link] Web server requests — who accessed what URL All (Apache)

/var/log/apache2/[Link] Web server errors — may reveal attack attempts All (Apache)

/var/log/dmesg Kernel/hardware messages from boot All

Live Monitoring Commands:

Task Command

Watch auth log live sudo tail -f /var/log/[Link]

Watch syslog live sudo tail -f /var/log/syslog

Follow systemd journal sudo journalctl -f

Follow SSH service logs sudo journalctl -u ssh -f

Capture network packets sudo tcpdump -i eth0

Save packets to file sudo tcpdump -i eth0 -w [Link]

Capture only HTTP sudo tcpdump -i eth0 port 80

Linux Log Entry Format — Reading a Log Line:

■ Example: Jan 6 15:10:22 server01 sshd[1123]: Failed password for root from [Link]

Field Value in Example Meaning

Timestamp Jan 6 15:10:22 When this event occurred

Hostname server01 Which machine generated this log

Process[PID] sshd[1123] SSH daemon, process ID 1123

Message Failed password for root from [Link] What happened — failed SSH login attempt for root

■ Multiple 'Failed password' lines from same IP = SSH Brute Force attack. Use fail2ban to auto-block after N failed attempts.
 9. Log Management & Network Packet Capture

A log is a record of events: who did what, when, where, and how. Logs are the primary evidence trail for every SOC
investigation.

Log Category Examples SOC Use

Host Logs Windows Event Logs, Linux Syslogs Detect logins, process execution, privilege changes

Network Logs Firewall logs, IDS/IPS alerts Detect scanning, C2 traffic, lateral movement

Application Logs Web server, database, app errors Detect SQLi, web shell uploads, app attacks

Authentication Logs Windows 4624/4625, [Link] Detect brute force, unauthorized access

Security Logs SIEM-aggregated events Correlation across all sources for alerts

Why Log Monitoring Matters for SOC:

• Detect attacks in real time before damage spreads
• Investigate incidents — logs are the forensic evidence trail
• Correlate events across multiple systems to see the full attack
• Meet compliance requirements (PCI-DSS, ISO 27001, SOC2)
• Reduce MTTD (how fast you detect) and MTTR (how fast you respond)

Network Packet Capture — tcpdump

tcpdump captures raw network traffic at packet level — shows what actually happened on the wire, not just what an
app logged.

tcpdump Command What It Does

sudo tcpdump -i eth0 Capture all packets on interface eth0

sudo tcpdump -i any Capture on ALL interfaces

sudo tcpdump -i eth0 port 80 Capture only HTTP traffic

sudo tcpdump -i eth0 -w [Link] Save capture to file for Wireshark analysis

sudo tcpdump -i eth0 -n Show IP addresses (no DNS resolution)

Pattern You See Likely Attack

Repeated SYN packets to many ports Port scan — attacker probing your network (Nmap)

Excessive ICMP Network probing or ping flood

Periodic outbound connections (beaconing) Malware communicating with C2 server

Large data transfer outbound Data exfiltration attempt

Centralized Log Collection Pipeline:

■ Endpoint → Agent (Wazuh/Winlogbeat) → Log Manager → SIEM (Splunk/ELK) → Dashboard → Alert Agents on each
machine forward logs to one central SIEM so analysts can see EVERYTHING in one place.
 10. SOC — Definition, Tasks & Components

A Security Operations Center (SOC) is a centralized facility running 24/7, dedicated to monitoring, threat detection,
analysis, and rapid response to cyber incidents. It is the nerve center of all defensive cybersecurity operations.

SOC Security Task Description

1. Threat Monitoring & Detection Continuously monitor alerts and detect threats in real time

2. Incident Response Contain, investigate, and recover from security incidents

3. Vulnerability Management Find and patch weaknesses before attackers exploit them

4. Identity & Access Management Control who has access to what resources

5. Endpoint & Network Security Protect devices and monitor network traffic

6. Compliance & Audits Ensure adherence to PCI-DSS, ISO 27001, GDPR etc.

7. Data Protection & Backup Protect data and ensure recovery capability

8. Security Automation Use SOAR to automate repetitive security tasks

SOC Components: People + Processes + Technology

Component Key Elements Why It Matters

■ People Tier 1/2/3 analysts, incident responders, threat hunters, Human judgment interprets alerts, reduces false
SOC manager positives, makes critical decisions

■■ Processes Incident triage workflow, escalation procedures, Consistent, repeatable procedures minimize confusion
vulnerability management, post-incident review and ensure rapid response

■■ Technology SIEM, EDR/XDR, IDS/IPS, SOAR, threat intelligence Enables real-time visibility, faster detection, and scalable
platforms, log management tools operations

■ A SOC FAILS if any one component is weak. Best technology is useless without skilled people and defined processes.
 11. SOC Maturity Models & Generations

Maturity Model Full Name Key Focus / Functions

NIST CSF NIST Cybersecurity Framework 5 Functions: Identify → Protect → Detect → Respond → Recover. Assess
maturity across each.

ISO 27001 International ISMS Standard Establish, implement, maintain & continually improve information security
(ISMS)

C2M2 Cybersecurity Capability Maturity Measures capability levels in risk management, threat/vuln management,
Model incident response

SOC Generations — Evolution Over Time

Generation Era Key Features

1st Gen 1970s Defense/govt agencies. Manual processes, basic tools. Focus: protect sensitive info.

2nd Gen 1990s Internet growth. Introduction of IDS. Real-time detection. Early alerting automation.

3rd Gen 2000s SIEM adoption. Centralized log collection & event correlation. Threat intelligence feeds.

4th Gen 2010s ML & AI analytics. Proactive threat hunting. Predictive security. Hybrid SOC + MSSPs.

5th Gen 2020s+ Unified approach. Continuous attack surface management. Heavy automation (SOAR). Reduce
dwell time.

SOC Implementation Steps

Step What to Do

1. Define Objectives Set goals: threat detection, incident response, compliance. Define scope across departments.

2. Assemble Team Recruit analysts, responders, hunters. Define clear roles and accountability.

3. Select Technology Deploy SIEM, IDS, EDR. Ensure tools integrate for centralized visibility.

4. Build IR Processes Establish detection, containment, investigation, and recovery procedures.

5. Training Continuous role-based training on new threats and tools.

6. Measure & Report Track MTTD/MTTR, maintain documentation, report to stakeholders.

 12. SOC KPIs & Metrics

KPIs measure how effectively the SOC detects and responds to threats. These are exam favorites!

KPI Definition Formula Low is Good / High is Good?

MTTD Mean Time to Average time from threat Sum of detection times ÷ Number of LOW is good. Low MTTD = less time
Detect entering network until SOC incidents for attacker to move. High = blind
detects it spots, more damage.

MTTR Mean Time to Average time from detection to Total resolve time ÷ Number of LOW is good. Low MTTR = faster
Respond full containment & recovery incidents response, less damage. High = more
cost, more risk.

Alert Handling Time Time analyst takes to assess Measured per analyst session LOW is good. High = alert overload or
and respond to one alert skill gaps.

False Positive Rate % of alerts that are benign (not (FP ÷ Total Alerts) × 100 LOW is good. High FP = analyst
real threats) fatigue, wasted time, reduced trust in
alerts.

Incident Escalation % of incidents escalated to (Escalated ÷ Total) × 100 LOW is good. High = skill gaps or
Rate higher-tier analysts overly complex alerts.

First Contact % of incidents resolved by Tier (Resolved at T1 ÷ Total) × 100 HIGH is good. High FCR = strong Tier
Resolution (FCR) 1 without escalation 1 capability.

■ MTTD improves with: ML/behavior analytics, centralized logs, updated detection rules, 24/7 monitoring. MTTR improves
with: Clear playbooks, good team coordination, automation (SOAR), effective tools.

Event vs Alert vs Incident

Term What It Is Examples Action Required

Event Any observable action in User login, file accessed, connection None — most are NORMAL. All events are
a system/network established, service started logged.

Alert Event(s) matching a Multiple failed logins, malware signature Investigate! Analyst triages to determine if
security rule or threshold detected, IDS rule triggered real threat.

Incident CONFIRMED security Successful ransomware, data exfiltration, IMMEDIATE response — contain,
event impacting CIA DDoS attack, account compromise investigate, recover.

■ Flow: Event → (matches rule) → Alert → (confirmed harmful) → Incident. Not all events become alerts. Not all alerts become
incidents. TRIAGE is the skill.
 13. SOC Structure — Three-Tier Model

SOC analysts are organized into 3 tiers by experience and responsibility. Alerts flow Tier 1 → 2 → 3 as complexity
increases.

Tier 1 — Triage Specialist Tier 2 — Incident Responder Tier 3 — Threat Hunter / Engineer

Main Role First responder — monitor & triage Investigate escalated incidents Handle most complex cases + build
alerts defenses

Key Tasks Alert monitoring, initial triage, false Deep investigation, attack Threat hunting, reverse
positive filtering, escalation scoping, containment, malware engineering, SIEM tuning,
analysis automation

Tools SIEM (Splunk, Wazuh, ELK), basic EDR, Autopsy, Volatility, MITRE ATT&CK;, YARA, SOAR,
threat intel NIST/SANS IR frameworks Python scripting, STIX/TAXII

Example Sees 50 failed logins → validates Traces attack scope, isolates Hunts for encoded PowerShell
it's brute force → escalates to T2 infected host, removes malware, commands → writes detection rule
restores from backup → automates via SOAR

SOC Analyst Skill Sets:

Skill Category Key Skills Why Needed

Technical Skills Networking (TCP/IP, DNS), OS (Windows/Linux), log Identify and validate security incidents using
analysis, SIEM tools, IDS/IPS, basic scripting tools

Analytical Skills Alert triage, pattern recognition, root cause analysis, Reduce alert fatigue and focus on real threats
correlating events, distinguishing FP from real attacks

Communication Skills Writing incident reports, explaining technical issues simply, Fast response, accountability, knowledge
escalation handling, documentation sharing

SOC vs NOC

Aspect SOC NOC

Objective Protect against cyber threats Ensure network performance & reliability

Focus Security monitoring, incident response Network health, uptime, performance metrics

Threats Hackers, malware, insider threats System failures, outages, degradation

Tools SIEM, EDR, IDS/IPS, threat intel Network monitoring, SNMP, performance
dashboards

Approach Proactive threat detection & hunting Reactive fault resolution & service restoration
 14. SOC Tools: SIEM · Ticketing · EDR

Tool What It Is Core Functions Examples Analogy

SIEM Security Centralized platform that • Aggregates logs from all sources Splunk, ELK Stack, Radar of the SOC —
Info & Event collects, normalizes, and • Detects patterns using Wazuh, IBM QRadar, scans everything,
Management correlates logs from correlation rules • Provides ArcSight highlights anomalies
entire IT environment dashboards & alerts • Supports
incident investigation

Ticketing Converts raw alerts into • Tracks incident lifecycle • Routes ServiceNow, JIRA, Air traffic control —
Incident Case trackable tickets, to correct tier • Maintains audit trail TheHive, RTIR doesn't fly planes, but
Management managed from open to • SLA tracking dashboard ensures every incident is
resolved tracked & resolved

EDR Endpoint Endpoint-level visibility • Monitors processes, memory, CrowdStrike Falcon, CCTV + security guard
Detection & and response — files • Detects malware, SentinelOne, Microsoft for every computer —
Response monitors laptops, ransomware • Remote: isolate Defender for Endpoint watches constantly,
servers, VMs host, kill process • Forensic intervenes immediately
telemetry collection

SIEM Ticketing EDR

Role Visibility Workflow Action

Question it answers What is happening across the Is this incident being handled What happened on this device?
network? properly?

■ SOC Triad: SIEM (Visibility) + Ticketing (Workflow) + EDR (Action) — All three must work together for effective security
operations.
 ■ QUICK REVISION CHEAT SHEET

Everything you need to remember — one page!

Topic Key Point(s) to Remember

CIA Triad Confidentiality=who sees, Integrity=not tampered, Availability=accessible when needed

Risk Formula Risk = Threat × Vulnerability × Impact

Security Controls Preventive=stop, Detective=identify, Corrective=fix after

6 Threat Actors Cybercriminals, Nation-state, Insider, Hacktivists, Cyber terrorists, Script kiddies

Attack Surface vs Vector Surface=what's exposed | Vector=HOW they attack

Vulnerability vs Risk Vulnerability=weakness exists | Risk=likelihood × impact of exploitation

OSI Mnemonic All People Seem To Need Data Processing (L7→L1)

Key Ports 22=SSH, 80=HTTP, 443=HTTPS, 53=DNS, 25=SMTP, 3389=RDP, 445=SMB

DNS Resolution Browser → Resolver → Root → TLD → Authoritative → IP Address

HTTPS Security TLS handshake: Certificate → Verify → Session Key → Encrypted data

DHCP = DORA Discover → Offer → Request → Acknowledge

SMTP Security STARTTLS (encrypt), SPF (sender IP), DKIM (signature), DMARC (policy)

Top Windows Event IDs 4624=login OK, 4625=login fail, 4688=process, 4697=service, 4720=user created

Linux Auth Log Ubuntu: /var/log/[Link] | RHEL: /var/log/secure

Live Log Commands tail -f /var/log/[Link] | journalctl -f | tcpdump -i eth0

SOC = 24/7 People + Processes + Technology — ALL three needed

SOC 3 Tiers T1=Triage, T2=Investigate, T3=Threat Hunt

MTTD Mean Time to Detect — LOW = good (fast detection)

MTTR Mean Time to Respond — LOW = good (fast containment)

Event→Alert→Incident Event(anything) → Alert(rule triggered) → Incident(confirmed threat)

False Positive Alert that looks malicious but is actually benign — high FP = analyst fatigue

SOC vs NOC SOC=security protection | NOC=network uptime/performance

SOC Tools Triad SIEM=Visibility | Ticketing=Workflow | EDR=Action on endpoints

SIEM Examples Splunk, ELK Stack, Wazuh, IBM QRadar

EDR Examples CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint

Maturity Models NIST CSF (5 functions), ISO 27001 (ISMS), C2M2 (capability levels)

SOC Generations 1970s→Manual | 1990s→IDS | 2000s→SIEM | 2010s→ML/AI | 2020s→Automation

■ Good luck with your externals! Understand WHY each control exists — not just what it is. Think like both attacker AND
defender. You've got this! ■