SOC & Incident Response
Detecting threats and responding as a security operations team.
Beginner
Start here. No background needed beyond school maths.
LetsDefend: Blue Team Training
Practise as a SOC analyst: triage real-looking alerts in a simulated monitoring console and investigate logs. Free account has a starter tier.
Sign up to see the source
MITRE ATT&CK
The shared knowledge base of attacker tactics and techniques that security teams use to describe and detect threats.
Sign up to see the source
Advanced
Once the basics are comfortable.
CISA Incident and Vulnerability Response Playbooks
Step-by-step playbooks that show how a response team works through an incident or a vulnerability, with flow charts and checklists.
Sign up to see the source
Incident Handler's Handbook
A practical white paper on running an incident: the six steps from preparation to lessons learned, with checklists for each.
Sign up to see the source
NIST SP 800-61 Rev. 3: Incident Response Recommendations
The current US standard for handling security incidents: preparing, detecting, responding and learning, tied to the wider cybersecurity framework.
Sign up to see the source
Computer Security Incident Handling Guide (SP 800-61)
The standard guide to preparing for, detecting and recovering from security incidents.
Sign up to see the source
Wazuh Documentation
Docs for the open-source platform that gathers logs and detects threats on servers and endpoints.
Sign up to see the source