Start here

ShiftLab lets you practise being a SOC Level 1 analyst on realistic alerts. Everything is fictional, so you cannot break anything.

What does a SOC Level 1 analyst do?

A SOC watches a company's systems for attacks. Security tools raise thousands of alerts, and most turn out to be harmless. The Level 1 analyst is the first person to look at each one. Your job is to work out quickly and carefully which alerts are real, write down what you found, and pass the serious ones to a senior colleague.

How a shift works

  1. 1

    Take an alert

    Open the Alert queue and press Assign to me. You work on one alert at a time, like a real shift.

  2. 2

    Read the briefing

    Each alert starts with what raised it, what the rule looks for and who is involved, plus questions to ask first.

  3. 3

    Investigate

    Study the evidence. Use the Intel lookup for IPs, domains and hashes, and the Log search for the wider picture.

  4. 4

    Decide

    Choose true positive or false positive, and whether to escalate. Both choices matter and are scored separately.

  5. 5

    Write your report

    Say what happened, what is confirmed, what is still unknown and what should happen next. Keep it short and factual.

  6. 6

    Learn from the feedback

    You get a score, what you missed and what really happened. Compare with a similar alert to sharpen your instinct.

Your first goals

How scoring works

Each case is out of 100, and the score is your decision: the verdict, whether to escalate, and that you wrote the report. Your wording is never scored, so a right call in your own words is a right call. How the report reads is coached afterwards instead, section by section, next to a model report you can compare against. On Beginner alerts a reason of one or two sentences is enough and the other three sections are optional, each adding marks. From Intermediate up the evidence is hidden: you must open at least 3 sources (4 on Hard and AI Era) before you can report, and 25 points move to how well you investigated. A wrong verdict caps the score at 40, and a report that contradicts the evidence caps it at 70.

  • VerdictTrue or false positive. A wrong verdict caps the whole score at 40.50
  • EscalationEscalate or handle it yourself.25
  • Report writtenMarks for writing the report, not for the words you choose.25

True positive, false positive, and escalation

True positive

The alert is right: something harmful or against policy really happened.

False positive

The alert fired, but there is a harmless explanation, such as an approved scan.

Escalate or not

A separate decision. A real attack that was fully blocked may need no escalation, and a real one that got in usually does.

Where to find things

Found something confusing or unrealistic?