Purple Edge
Get started

SOC Level 1

beginner8 labsSubscription

Your first rung as a defender: what a Security Operations Center does, how to read Linux, network, web and Windows logs, how a SIEM turns them into alerts, how to triage an alert and when to escalate it, ending with a hands-on shift on a real alert queue. Builds on Security Foundations.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    beginner Subscription

    What a SOC Does

    What a Security Operations Center does all day, how an alert moves through it, who does which job, and why the logs come first.

    35 min3 tasksfoundations
  2. 2
    beginner Subscription

    Reading Linux, Firewall and Web Logs

    Where the most useful Linux, firewall and web server logs live, how to read one line of each, and the patterns a Tier 1 analyst looks for.

    45 min3 tasksfoundations
  3. 3
    beginner Subscription

    Reading Windows Logs and Sysmon

    Read Windows like a Tier 1 analyst: who signed in and how, which accounts changed, what program started what, and how to line the events up in time.

    50 min3 tasksfoundations
  4. 4
    beginner Subscription

    How a SIEM Works: Agents, Decoders and Alerts

    How logs from hundreds of machines reach one screen, how plain text becomes searchable fields, and how to read one alert record from top to bottom.

    40 min3 tasksfoundations
  5. 5
    beginner Subscription

    Dashboards and Alerts: Reading the SIEM

    See the shape of activity at a glance on a dashboard, then read what makes one alert more urgent than another: its rule, level, group and frequency.

    45 min3 tasksfoundations
  6. 6
    beginner Subscription

    Alert Triage: True or False Positive?

    The core Tier 1 skill: take one alert, pull out its facts, check them against other logs and context, and reach a clear disposition.

    45 min3 tasksfoundations
  7. 7
    beginner Subscription

    Escalation, Triage Notes and Handover

    What happens after the disposition: when to escalate, how urgent it is, how to write a note the next analyst can act on, and how to hand a shift over without losing anything.

    40 min3 tasksfoundations
  8. 8
    beginner Hands-on lab Subscription

    Capstone: Your First Shift on the Queue

    Deploy a real lab, work a queue of three alerts as the Tier 1 analyst on shift, give each the right disposition, escalate the true positive and capture the escalation flag.

    75 min3 tasksfoundations

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-11-01

We use cookies for analytics and advertising to improve Purple Edge and measure our campaigns. You can accept or decline non-essential cookies.