SOC Analyst with Wazuh: Detecting and Responding to Attacks
Exit

Lesson 9 of 11 · Responding and investigating

Investigation: from the alert to the attack timeline

45 min Debian 12

Objective

Start from a single alert and rebuild the complete story of an incident: who, what, when, on which machine, in what order. This is the core of an L2 SOC analyst's work, and the raw material of the incident report (lesson 3.3).

This lesson is part of the full course

Unlock SOC Analyst with Wazuh: Detecting and Responding to Attacks to read every lesson, do the exercises, access the simulations and earn your certificate.

Buy — 290 MAD All-access pass — 1,490 MAD

Already enrolled? Log in.