SOC Analyst & Blue Team

A SOC analyst monitors an organisation's systems for attacks. The work combines triage of alerts, deeper investigation of the ones that look real, and improving detection rules so that the next attempt is caught earlier.

An event is anything a system records, such as a login. An alert is an event or pattern a rule has flagged for human review. An incident is a confirmed or strongly suspected security violation, such as an unauthorised login.

Count failed password lines per source IP with grep, awk, sort and uniq -c, then list accepted logins. A successful login from an address that was failing shortly before is the pattern that indicates the guessing worked.

A SIEM query uses the same thinking as a shell pipeline: filter, extract a field, group and count. Learning it on raw logs shows you what the tool does and lets you investigate when a log source is missing or the SIEM is unavailable.

Repeated password guessing maps to T1110 Brute Force. A successful login with a real account's password maps to T1078 Valid Accounts. Using these IDs in reports makes findings comparable across teams and tools.

Debian and Ubuntu write SSH events to /var/log/auth.log only when rsyslog is installed; journal-only hosts keep them in the systemd journal, readable with journalctl -u ssh. Red Hat–family systems use /var/log/secure. Older events may sit in rotated files such as auth.log.1 or auth.log.2.gz, which zgrep can search.