SOC Missions
Practise investigating incidents, one scenario at a time
SOC missions are scenario-based exercises built around the alert-investigation workflow — from a single suspicious email to a cloud intrusion.
How missions work
Start from an alert
Each scenario begins the way real investigations do: with an alert and very little context.
Investigate methodically
Work through context gathering, indicator enrichment, and timeline building step by step.
Decide & escalate
Reach a true- or false-positive verdict and decide what to escalate, and why.
Document & learn
Write up what you found and how — the habit that makes every next investigation faster.
Scenarios
Example mission scenarios
From beginner-friendly triage to advanced threat hunting. Use the investigation guide as your playbook.
The Phishing Foothold
A finance employee clicked a link. Trace the initial access, identify the payload, and contain the host.
Beacon in the Night
Recurring outbound traffic hints at C2. Correlate proxy logs and confirm the compromise before it spreads.
Ransom Countdown
Mass file encryption is underway. Reconstruct the kill chain and scope the blast radius under pressure.
The Insider Anomaly
Off-hours access to sensitive shares. Separate legitimate activity from data staging and exfiltration.
Living off the Land
No malware, only native tooling. Hunt an APT abusing PowerShell and WMI to move laterally.
Cloud Break-In
Anomalous IAM activity in AWS. Follow the trail from exposed keys to privilege escalation.
How it works
Learn by investigating, not memorizing
Every mission follows the same loop real analysts use: triage, investigate, decide, and document.
Read the alert
Start with what fired, where, and for whom — and rule out the obvious false positives.
Investigate & correlate
Pivot through logs, enrich indicators, and build a timeline of what happened.
Reach a verdict
Decide true or false positive, document your findings, and escalate when it matters.
Review and improve
Compare your reasoning with the investigation guide and note what you would do differently.
Learn with the Society
Explore more free resources in our community hub, or ask about practical security training for your team.