✳ Learning path / 4 lessons
SOC analyst introduction
Four lessons that take the foundations path into evidence-to-decision work: identity-alert triage, vulnerability prioritization, investigation with verified recovery, and an honest introduction to an Agentic SOC and IRIS. Each lesson lists the foundation skills it depends on.
Work through the lessons in sequence, or choose the question you want to answer today.
01Triage a synthetic identity alert
Practice stating what is known, what is hypothesized, and which evidence to request next when a synthetic identity alert fires.
Prioritize vulnerabilities and exposures
Combine severity, exploitation evidence, exposure, and business context to order a synthetic vulnerability backlog without pretending a single score is enough.
Investigate, respond, and verify recovery
Propose a scoped response with a human decision and postcondition checks, using a synthetic identity-and-export case.
Understand and build toward an Agentic SOC
Explain IRIS components as a reference architecture, complete a synthetic walkthrough, and keep human authority separate from model text.
Turn knowledge into a decision.
Once you have the ideas, try a short scenario. You’ll see why the tempting answer isn’t always the most useful one.
Open the practice range ↗