Purple Edge
Get started

SOC Analyst & SIEM

intermediate5 labsSubscription

Foundational blue-team skills: log-source literacy, standing up a Wazuh SIEM, building dashboards and alerts, triaging alerts, and analyzing Windows event logs.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    beginner Hands-on lab Subscription

    SOC Fundamentals & Log Sources

    Learn what a Security Operations Center does and get fluent in the canonical log sources every analyst lives in: authentication logs, Sysmon, firewall, and web server logs - and the specific events that actually matter.

    35 min3 tasksSOC & SIEM
  2. 2
    beginner Hands-on lab Subscription

    Building a SIEM with Wazuh

    Stand up a Wazuh SIEM from scratch: deploy the manager, enroll a Linux and a Windows agent, and confirm that events are flowing and being decoded end to end.

    45 min3 tasksSOC & SIEM
  3. 3
    beginner Hands-on lab Subscription

    Dashboards & Alerting

    Turn raw events into actionable signal: build a Wazuh dashboard for visibility and write a custom detection rule that fires when a condition you define is met.

    45 min3 tasksSOC & SIEM
  4. 4
    intermediate Hands-on lab Subscription

    Alert Triage & Investigation

    Work a fired alert end to end the way a Tier-1 analyst does: pivot from the alert to the host, to the process, to a verdict - extracting IOCs and reaching a defensible disposition.

    50 min3 tasksSOC & SIEM
  5. 5
    intermediate Hands-on lab Subscription

    Windows Event-Log Analysis

    Read Windows like an analyst: reconstruct a complete logon-plus-process-execution sequence from the Security and Sysmon event logs, distinguishing normal activity from an attacker's footprints.

    50 min3 tasksSOC & SIEM

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-06-06