Blue Team: SOC & Defensive Security
Investigate a compromised host the way a SOC analyst does.
- Estimated time
- 3 hours
- Rooms
- 5 rooms
- Points
- 1025 pts
- Enrolled
- 1 learner enrolled
About this path
Defenders work backwards from evidence. This path puts you in the responder's seat: given logs, a captured network trace, and a host that was pulled offline after suspicious activity, you reconstruct what the attacker did and recover what they tried to hide. You practise the day-to-day skills of a Security Operations Centre — log triage, timeline building, and spotting persistence.
Who should start here
Analysts and aspiring defenders who want hands-on incident-response practice: reading logs, following an intrusion through the artefacts it leaves, and understanding attacker techniques from the defender's side.
Prerequisites
Comfort on a Linux shell (cat, grep, less) and reading common log formats. A little base64/XOR decoding helps. The Pre-Security path is a good warm-up.
What you will be able to do
- Triage authentication and web-server logs to separate noise from the real intrusion
- Build an incident timeline from disparate evidence
- Detect and read attacker persistence (systemd units, cron, scripts)
- Recover staged or deleted artefacts from a live host
- Reverse simple real-world obfuscation to read what was exfiltrated
Curriculum
Module 1 — Evidence & recovery0 of 1 rooms complete
What 'deleted' really means to a responder.
Module 2 — Network evidence0 of 1 rooms complete
The one protocol nobody blocks.
Module 3 — Host incident response0 of 3 rooms complete
Reconstruct an intrusion end to end.