Purple Edge
Get started

SOC Analyst and SIEM

intermediate5 labsSubscription

Become an effective SOC analyst: SIEM fundamentals, log onboarding, detection engineering, alert triage, and a live intrusion capstone.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    beginner Hands-on lab Subscription

    SIEM Fundamentals for the SOC

    Understand what a SIEM does, how events flow through it, and where a detection actually lives.

    35 min3 tasksblue-team
  2. 2
    beginner Hands-on lab Subscription

    Onboarding Log Sources

    Get the right telemetry into the SIEM: which sources matter, how to ship them, and how to confirm coverage.

    40 min3 tasksblue-team
  3. 3
    intermediate Hands-on lab Subscription

    Writing Detection Rules

    Turn a known attacker behaviour into a detection that fires on the real thing and stays quiet otherwise.

    55 min3 tasksblue-team
  4. 4
    intermediate Hands-on lab Subscription

    Alert Triage and Investigation

    Work an alert like a SOC analyst: scope it, decide true or false positive, and reconstruct what happened.

    50 min3 tasksblue-team
  5. 5
    advanced Hands-on lab Subscription

    Capstone: Work a Live Intrusion

    Take a fresh alert and run the full SOC workflow to scope an intrusion and recommend containment.

    85 min3 tasksblue-team

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-09-01