What to Learn Before Joining an IR Rotation or SOC: A Checklist and 30-Day Plan
Before joining an incident response rotation or a SOC, be able to do ten things: read network traffic basics (TCP/IP, DNS, HTTP, common ports); read Windows security logs (logon events 4624 and 4625, process creation 4688, account creation 4720, service installs 7045, log clearing 1102) and Linux auth logs; write simple SIEM searches in your team’s query language (KQL or SPL); triage an identity alert; analyse a phishing email’s SPF, DKIM and DMARC results; map activity to MITRE ATT&CK; follow the incident lifecycle in NIST SP 800-61r3; handle evidence with a chain of custody; know your severity and escalation rules; and write a clear ticket and timeline. Learn each with free resources and practise in browser labs; a focused 30-day plan of about an hour a day covers the essentials.
Your first SOC shift or incident rotation goes better if you have already done the basic moves a few times. This is the checklist we would give a new analyst, with a free way to learn each skill and a browser lab to practise it.
What should you be able to do on day one?
| Skill | What you should be able to do | Free way to learn | Practise on PlayCISO |
|---|---|---|---|
| Networking | Explain TCP/IP, DNS, HTTP/S and common ports; spot unusual outbound traffic | Cisco Networking Academy Introduction to Cybersecurity | Firewall Rule Lab, Egress Proxy Lab |
| Windows logs | Read 4624/4625 logons and logon types, 4688 process creation, 4720 account creation, 4728/4732 group changes, 7045 service installs, 1102 log clearing | Microsoft Learn security operations paths | SOC Log Triage Trainer |
| Linux logs | Read auth logs and the systemd journal; spot brute force and new sudo users | Distribution documentation; Blue Team Labs Online challenges | SOC Case Triage Lab |
| SIEM queries | Filter, count and time-bucket events in your team’s language (KQL or SPL) | Microsoft Learn KQL modules; Splunk’s free training | Detection Lab |
| Identity | Triage impossible travel, MFA fatigue and new privileged accounts | Microsoft Learn Entra ID security modules | MFA Bypass Lab, ITDR Lab |
| Email and phishing | Read headers and SPF, DKIM and DMARC results; decide whether to purge | LetsDefend free phishing lessons | Email Authentication Lab, Pick the Phish |
| MITRE ATT&CK | Map what you see to a tactic and technique | attack.mitre.org | APT Knowledge Graph |
| IR lifecycle | Follow NIST SP 800-61r3 (aligned to NIST CSF 2.0) and your own IR plan | NIST SP 800-61r3 (free); CISA training | IR Playbook Lab |
| Evidence handling | Preserve before you change; record who touched what and when | NIST guidance; your IR plan | Forensics Lab, Chain-of-custody form |
| Severity and escalation | Apply your severity matrix; know when to wake someone up | Your organisation’s IR plan | Incident Severity Router, Escalation Threshold Lab |
| Writing | Write a ticket a colleague can pick up, and a timeline in UTC | Read your team’s best closed tickets | Post-Incident Review Template |
What should you learn about your own organisation first?
Technical skill transfers between employers; local knowledge does not. Before the first shift, find and read:
- The incident response plan and the severity matrix.
- The on-call and escalation list, including legal, communications and the managed security provider if you have one.
- The “crown jewels”: which systems and data matter most, and who owns them.
- The tools you will use: SIEM, EDR, ticketing, case management, and how to get access on day one.
- The last three post-incident reviews. They show how your team actually works.
What does a 30-day preparation plan look like?
About an hour a day, before or in your first month:
- Days 1 to 7, foundations. Networking and Windows logs. Take the SOC Log Triage Trainer on day 1 and note your score.
- Days 8 to 14, queries and identity. Ten KQL or SPL searches a day against sample data; identity labs.
- Days 15 to 21, incidents. Read NIST SP 800-61r3’s overview; run the IR Playbook Lab and two Virtual SOC cases; write one investigation up.
- Days 22 to 30, rehearsal. A full incident simulation in the Cyber War Room or a team tabletop, then repeat the triage trainer and compare your score with day 1.
Team leads can use the same plan as a 30-day onboarding plan for junior analysts: week 1 tools and the IR plan, week 2 shadow shifts, week 3 low-severity alerts with review, week 4 a tabletop and a first solo shift with a named escalation buddy.
Which certification helps for a SOC analyst career?
None is required to learn the checklist above, but job ads filter on them. As of October 2026: CompTIA Security+ (US$439) for the filter, then a hands-on analyst exam: CySA+ (US$439), Blue Team Level 1 (£399 including training, 24-hour practical) or Cisco CyberOps Associate (US$300). Choose SC-200 if your SOC runs Microsoft Sentinel and Defender. See certifications that boost an IR career for the senior steps, or build a sequence with the Cyber Certification Roadmap.
How does practice in a browser compare with other options?
Browser labs such as PlayCISO’s are quick to start and good for repetition and decision practice; they do not give you a full virtual machine to investigate. For deeper forensics on real images, use Blue Team Labs Online, CyberDefenders or LetsDefend, and for full attack-and-defend machines, TryHackMe or Hack The Box. A good preparation plan uses both: browser labs for daily repetition, full environments for depth.
Checklist: am I ready for my first shift?
- I have read the IR plan and know the severity levels.
- I can explain 4624 logon types and find 4688 process creation for a host.
- I can write a SIEM search that counts events per user per hour.
- I can read SPF, DKIM and DMARC results in a header.
- I know who to escalate to, and when, by name.
- I have worked at least one practice incident end to end and written it up.
- I know how to preserve evidence before I change anything.
Frequently asked questions
What should I learn before joining an IR rotation?
Your organisation’s incident response plan and severity levels, the NIST SP 800-61r3 lifecycle, Windows and identity log analysis, basic SIEM queries in your team’s language, evidence handling with a chain of custody, and how to write a timeline. Run at least one practice incident end to end in a lab or tabletop before your first shift.
Which certification is best for a SOC analyst career?
CompTIA Security+ (US$439 as of October 2026) to get through filters, then a hands-on analyst certification: CompTIA CySA+, Blue Team Level 1 or Cisco CyberOps Associate. Microsoft SC-200 helps if the SOC runs Sentinel and Defender. GIAC GCIH comes later, usually employer-funded.
What does an onboarding plan for junior analysts in 30 days look like?
Week 1: environment, tools, the IR plan and severity matrix. Week 2: shadow shifts and triage practice on closed tickets. Week 3: work low-severity alerts with review. Week 4: a tabletop exercise and a first solo shift with a named escalation buddy. Check progress with the same triage lab on day 1 and day 30.
Which Windows event IDs should a SOC analyst know?
At minimum 4624 (successful logon), 4625 (failed logon), 4672 (special privileges assigned), 4688 (process creation), 4720 (user account created), 4728/4732 (user added to a privileged group), 7045 (service installed) and 1102 (audit log cleared). Know the logon types in 4624, because they separate interactive, network and remote logons.
Ready to practise the decisions these articles describe?
Run your first War Room free →One run free with a free account · more runs with Pro