SOC Workbooks and Lookups

Alert triage is a complex process that often requires analysts to gather additional information about affected employees or servers. This room explores SOC workbooks designed to streamline alert triage and explains various lookup methods to quickly retrieve user and system context.

Learning Objectives

• Familiarise yourself with SOC investigation workbooks
• Learn where to find and how to use asset inventory in SOC
• Understand the importance of corporate network diagrams
• Practice workflow building inside an interactive interface

Prerequisites

• Complete the SOC L1 Alert Triage and Alert Reporting rooms
• Have practice with investigating common attack chains
• Understand the fundamental networking concepts
• Preferably, be familiar with the concept of SOAR playbooks