Purple Edge
Get started

SOC Analyst and SIEM

intermediate5 labsSubscription

Work inside a SIEM the way a SOC analyst does: search the data, check your log sources, write and tune a detection, triage alerts, and follow one intrusion from the first alert to containment. Hands-on in a lab, no install.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    intermediate Hands-on lab Subscription

    SIEM Fundamentals: From Event to Search

    Follow one event from the machine that wrote it to the alert an analyst sees, then search real SIEM data yourself: filter it, count it, and find who is behind a burst of failed logons.

    45 min3 tasksfoundations
  2. 2
    intermediate Hands-on lab Subscription

    Log Sources, Coverage and Dashboards

    You cannot detect what you do not collect. Check which log sources the SIEM should have, which are actually sending, which are silent, and which send events the SIEM cannot read, using a source inventory and a simple dashboard.

    50 min3 tasksfoundations
  3. 3
    intermediate Hands-on lab Subscription

    Writing, Tuning and Correlating Detection Rules

    Turn a behaviour into a detection rule, see why the first version drowns analysts in noise, tune it without going blind, combine two signals into one strong alert, and map it to MITRE ATT&CK.

    60 min3 tasksfoundations
  4. 4
    intermediate Hands-on lab Subscription

    Alert Triage and Investigation

    Work an alert queue like a SOC analyst: gather context before judging, decide true or false positive with evidence, pivot from one record to the next, and build the timeline of what happened.

    55 min3 tasksfoundations
  5. 5
    intermediate Hands-on lab Subscription

    Capstone: Work an Intrusion End to End

    One new alert, the whole SIEM, and you. Confirm the intrusion, scope every host and account it touched, find where the infected machines report to, and recommend containment.

    90 min3 tasksfoundations

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-11-01

We use cookies for analytics and advertising to improve Purple Edge and measure our campaigns. You can accept or decline non-essential cookies.