Welcome Back, Detective! 🔧
You've learned about IP addresses and domain names. Now let's explore the tools and logs SOC analysts use every day!
⚔️ The Attacker's Playbook: The Kill Chain
Before we learn about defensive tools, let's understand how attackers think. Every attack follows a pattern called the Kill Chain.
🎯 Why This Matters
The attacker has a plan. Your job is to detect them early and disrupt that plan before they reach their goal!
Click each stage to learn about it:
🎯 Know Your Kill Chain
Before we learn the defensive tools, let's make sure you've got the Kill Chain stages down! Match each stage to its description.
Match all stages (0/5 matched)
📋 Authentication Logs: The Digital Sign-In Sheet
Authentication logs record every single login attempt. Think about when you sign in at the front desk of an office building - they write down your name, the time, and who you're visiting.
🏢 Real-World Analogy
Just like a building's front desk keeps a visitor log, our systems automatically record: WHO logged in, WHEN they logged in, and WHERE they logged in from.
Use the terminal to search authentication logs:
👆 Click all 3 command buttons above to search authentication logs
🌐 Web Traffic Logs: The Internet Hall Monitors
Use the terminal to search web proxy logs:
👆 Click both command buttons above to search web proxy logs
🧱 Firewall: The Digital Bouncer
A firewall is like a security guard at the entrance to our network. It checks everyone trying to get in and decides: allowed or not allowed?
🚪 Club Bouncer Analogy
Think about a club with a bouncer and a "banned" list. If someone caused trouble before, the bouncer adds their name to the list. Next time they show up - no entry!
Click malicious IPs to add them to the blocklist:
Incoming Traffic
Blocklist
Block all malicious IPs to continue
📬 Alert Queue: Prioritize the Threats
Every time our systems detect something suspicious, it creates an alert. SOC analysts must prioritize which alerts to investigate first!
⚠️ The Alert Fatigue Problem
SOC analysts can get hundreds of alerts per day. You can't investigate them all at once - you need to rank them by priority and tackle the most critical ones first!
🎯 Connecting the Dots: Offense ↔ Defense
You've learned the Kill Chain (how attackers think) AND the SOC tools (how we defend). Now let's put it all together!
💡 The Big Picture
At each attack stage, there are specific signs we look for. Match each stage to what we'd detect!
Note: Weaponization happens off-network, so it's not in this exercise - we can't detect what we can't see!
Match all items (0/4 matched)
🎯 Knowledge Check
Answer these questions to earn your Log Analyst Certificate!
Log Analyst Certificate
Security Operations Fundamental Series - Module 3 Complete
Bronze Level
Your Name
Has demonstrated understanding of the Kill Chain, authentication logs, web proxy logs, firewalls, and alert management.
What's Next?
In Module 4: Your First Case, you'll put all these skills together to investigate a real phishing attack!