The SOC analyst job: tiers, SIEM, incidents and MITRE ATT&CK

Objective

Understand what an analyst really does in a SOC (Security Operations Center), how an alert becomes an incident, and speak the common language of the profession: SIEM, XDR, tiers L1-L2-L3 and MITRE ATT&CK. This lesson sets the scene for the whole course.

Key points

• A SOC is the team (and the room) that continuously monitors an organization's systems to detect attacks and respond to them quickly.
• Analysts are organized in tiers: L1 triages alerts, L2 investigates and contains, L3 hunts threats and handles complex cases.
• A SIEM collects and correlates logs; an EDR protects each endpoint; an XDR connects the two. Wazuh is a free and open source platform that does both SIEM and XDR.
• An incident follows a life cycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned.
• MITRE ATT&CK is a public catalog of attacker behaviors: tactics (the "why") and numbered techniques (the "how"), for example T1110 for brute force.

A day in a SOC

Picture the SOC of a bank in Casablanca. It is 8:05 a.m. The dashboard shows 1,240 alerts since midnight. Nobody can read them all one by one: the job is to triage.

Sarah, an L1 analyst, opens the queue. Most alerts are noise: antivirus updates, log rotations, normal logins. Yet she spots one line: 48 failed SSH passwords on a web server, from a foreign address, followed by one successful login. This is no longer noise. She qualifies the alert, writes her first observations in the ticket and escalates it to L2.

Youssef, an L2 analyst, takes over the ticket. He looks at what the account did after logging in, isolates the server, blocks the address and warns the system team. By noon, the threat is contained; he writes the report.

You will replay this scenario from start to finish in this course, on your own machine.

Analyst tiers

In Morocco, these jobs exist in banks and insurance companies, at telecom operators, in ministries and large public institutions, and at managed security service providers (MSSP) that monitor several clients from Casablanca or Rabat, often for European clients too. The L1 position is the classic entry point.

Two metrics to know

• MTTD (Mean Time To Detect): the average time between the start of an attack and its detection.
• MTTR (Mean Time To Respond): the average time between detection and containment.

A good SOC lowers both. A well-written detection rule (lesson 2.2) reduces the MTTD; a well-tuned active response (lesson 3.1) reduces the MTTR.

SIEM, EDR, XDR, SOAR: who does what?

Wazuh combines an agent installed on the machines (log monitoring, file integrity, vulnerabilities, active response) and a central server that analyzes and correlates: it therefore covers both the SIEM role and the XDR role. It is free and open source (GPLv2 license) and costs nothing, which makes it an excellent tool for learning, and a real choice for many SMEs and public administrations.

Triage vocabulary

• Event: a log line ("successful SSH login"). Millions per day.
• Alert: an event (or a group of events) that a rule found interesting. In Wazuh, each alert has a level from 0 to 15.
• Incident: a confirmed alert that harms (or threatens to harm) confidentiality, integrity or availability.
• True positive: the alert matches a real attack.
• False positive: the alert fired by mistake (an administrator who mistypes their password three times).
• False negative: a real attack without an alert. This is the most dangerous case, because it is invisible.

An L1 analyst spends a large part of their time discarding false positives. A good L2 or L3 analyst reduces their number by refining the rules.

The incident life cycle

The most cited reference is the NIST SP 800-61 guide. Remember these steps:

  1. Preparation ──► 2. Detection and analysis ──► 3. Containment ──► 4. Eradication ──► 5. Recovery
        ▲                                                                                     │
        └──────────────────────── 6. Lessons learned (post-incident activity) ◄──────────────┘

In Morocco, the DGSSI (Direction générale de la sécurité des systèmes d'information, the national information systems security agency) hosts maCERT, the national center for monitoring and incident response. Public administrations and operators of vital importance have security and incident reporting obligations (law 05-20 on cybersecurity). If personal data is affected, law 09-08 and the CNDP (the data protection authority) also come into play. You will see these aspects in the lesson on the incident report.

MITRE ATT&CK: the common language

MITRE ATT&CK is a public and free knowledge base, built from attacks actually observed in the wild. It classifies what attackers do into:

• Tactics: the attacker's goal at a given stage (get access, stay, steal credentials…). IDs look like TA00xx.
• Techniques: the way to reach that goal. IDs look like Txxxx, and Txxxx.yyy for sub-techniques.

Some tactics of the Enterprise matrix, in the order of a typical attack:

And the techniques you will meet most often in this course:

Wazuh already maps many of its rules to ATT&CK techniques: when an alert appears in the dashboard, you see T1110 right next to it. This lets you speak the same language as a colleague from another SOC, as maCERT or as an international threat report.

# In a Wazuh alert (JSON format), the MITRE part looks like this:
#   "rule": { "id": "5763", "level": 10,
#             "mitre": { "id": ["T1110"], "tactic": ["Credential Access"] } }

Triage: a simple method

Faced with a queue of alerts, an L1 analyst always asks the same questions, in this order:

1. Severity: what level? Levels 10 to 15 come before the rest.
2. Affected asset: a payment server matters more than a test workstation.
3. Context: is the address internal (10.x) or external? Is the account a service account?
4. Sequence: do several alerts tell the same story (failures, then success, then an account created)?
5. Decision: false positive (document it and close it), true positive (escalate), doubt (escalate too).

# A preview of what you will do on the command line in the lab:
awk -F';' 'NR>1 && $2>=10' alertes.csv          # alerts of level 10 and above
sort -t';' -k2,2nr alertes.csv | head           # sort by decreasing level
grep '203.0.113.45' alertes.csv                 # pivot on an IP address

Common pitfalls

• Judging an alert on its own: 48 failed passwords are commonplace on the Internet; 48 failures followed by a success are an incident. Always look at what comes before and after.
• Closing an alert without a trace: even a false positive is documented in one sentence. Otherwise, the night-shift colleague will redo the same work.
• Mixing up tactic and technique: "Credential Access" is a tactic (TA0006), "Brute Force" is a technique (T1110).
• Believing the tool does everything: Wazuh produces alerts; the analyst is the one who turns them into a diagnosis.

Lab

You start your first L1 shift. A file /root/soc/alertes.csv contains ten alerts from the night. You will:

1. map the burst of password attempts to its MITRE technique;
2. do the same for the account created without authorization;
3. count the alerts of level 10 or higher;
4. prepare the work queue, from the most severe to the least severe.

Start the lab on your work machine with sudo ml demarrer wazuh-1-1, then check with sudo ml verifier.

Quiz

1. What is the difference between the role of an L1 analyst and that of an L2?
2. What is a false negative, and why is it more dangerous than a false positive?
3. List the steps of the incident life cycle according to NIST.
4. Is T1110 a tactic or a technique? And TA0006?
5. Why is Wazuh described as both a SIEM and an XDR?

Reference sources: Wazuh documentation (CC BY-SA 4.0), MITRE ATT&CK, NIST SP 800-61, DGSSI/maCERT. Original MasterLinux text.