# What to Learn Before Joining an IR Rotation or SOC: A Checklist and 30-Day Plan

> The skills to have before your first SOC shift or incident response rotation: networking, Windows and Linux logs, SIEM queries, identity, email, MITRE ATT&CK, NIST SP 800-61r3, evidence handling and writing. With free resources, browser labs and a 30-day plan.

Source: https://playciso.com/blog/what-to-learn-before-joining-ir-rotation-or-soc · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

Your first SOC shift or incident rotation goes better if you have already done the basic moves a few times. This is the checklist we would give a new analyst, with a free way to learn each skill and a browser lab to practise it. ## What should you be able to do on day one? SkillWhat you should be able to doFree way to learnPractise on PlayCISO **Networking**Explain TCP/IP, DNS, HTTP/S and common ports; spot unusual outbound trafficCisco Networking Academy Introduction to Cybersecurity[Firewall Rule Lab](/tools/firewall-lab), [Egress Proxy Lab](/tools/proxy-lab) **Windows logs**Read 4624/4625 logons and logon types, 4688 process creation, 4720 account creation, 4728/4732 group changes, 7045 service installs, 1102 log clearingMicrosoft Learn security operations paths[SOC Log Triage Trainer](/tools/soc-triage) **Linux logs**Read auth logs and the systemd journal; spot brute force and new sudo usersDistribution documentation; Blue Team Labs Online challenges[SOC Case Triage Lab](/tools/case-triage) **SIEM queries**Filter, count and time-bucket events in your team’s language (KQL or SPL)Microsoft Learn KQL modules; Splunk’s free training[Detection Lab](/tools/detection-lab) **Identity**Triage impossible travel, MFA fatigue and new privileged accountsMicrosoft Learn Entra ID security modules[MFA Bypass Lab](/tools/mfa-bypass-lab), [ITDR Lab](/tools/itdr-lab) **Email and phishing**Read headers and SPF, DKIM and DMARC results; decide whether to purgeLetsDefend free phishing lessons[Email Authentication Lab](/tools/email-auth-lab), [Pick the Phish](/arcade/pick-the-phish) **MITRE ATT&CK**Map what you see to a tactic and techniqueattack.mitre.org[APT Knowledge Graph](/tools/apt-knowledge-graph) **IR lifecycle**Follow NIST SP 800-61r3 (aligned to NIST CSF 2.0) and your own IR planNIST SP 800-61r3 (free); CISA training[IR Playbook Lab](/tools/ir-playbook-lab) **Evidence handling**Preserve before you change; record who touched what and whenNIST guidance; your IR plan[Forensics Lab](/tools/forensics-lab), [Chain-of-custody form](/tools/evidence-chain-of-custody-form) **Severity and escalation**Apply your severity matrix; know when to wake someone upYour organisation’s IR plan[Incident Severity Router](/tools/incident-severity-router), [Escalation Threshold Lab](/tools/escalation-threshold-lab) **Writing**Write a ticket a colleague can pick up, and a timeline in UTCRead your team’s best closed tickets[Post-Incident Review Template](/tools/post-incident-review-template) ## What should you learn about your own organisation first? Technical skill transfers between employers; local knowledge does not. Before the first shift, find and read: - The incident response plan and the severity matrix. - The on-call and escalation list, including legal, communications and the managed security provider if you have one. - The “crown jewels”: which systems and data matter most, and who owns them. - The tools you will use: SIEM, EDR, ticketing, case management, and how to get access on day one. - The last three post-incident reviews. They show how your team actually works. ## What does a 30-day preparation plan look like? About an hour a day, before or in your first month: - Days 1 to 7, foundations. Networking and Windows logs. Take the SOC Log Triage Trainer on day 1 and note your score. - Days 8 to 14, queries and identity. Ten KQL or SPL searches a day against sample data; identity labs. - Days 15 to 21, incidents. Read NIST SP 800-61r3’s overview; run the IR Playbook Lab and two Virtual SOC cases; write one investigation up. - Days 22 to 30, rehearsal. A full incident simulation in the Cyber War Room or a team tabletop, then repeat the triage trainer and compare your score with day 1. Team leads can use the same plan as a 30-day onboarding plan for junior analysts: week 1 tools and the IR plan, week 2 shadow shifts, week 3 low-severity alerts with review, week 4 a tabletop and a first solo shift with a named escalation buddy. ## Which certification helps for a SOC analyst career? None is required to learn the checklist above, but job ads filter on them. As of October 2026: CompTIA Security+ (US$439) for the filter, then a hands-on analyst exam: CySA+ (US$439), Blue Team Level 1 (£399 including training, 24-hour practical) or Cisco CyberOps Associate (US$300). Choose SC-200 if your SOC runs Microsoft Sentinel and Defender. See [certifications that boost an IR career](/blog/certifications-that-boost-incident-response-career) for the senior steps, or build a sequence with the [Cyber Certification Roadmap](/tools/cyber-cert-roadmap). ## How does practice in a browser compare with other options? Browser labs such as PlayCISO’s are quick to start and good for repetition and decision practice; they do not give you a full virtual machine to investigate. For deeper forensics on real images, use Blue Team Labs Online, CyberDefenders or LetsDefend, and for full attack-and-defend machines, TryHackMe or Hack The Box. A good preparation plan uses both: browser labs for daily repetition, full environments for depth. ## Checklist: am I ready for my first shift? - I have read the IR plan and know the severity levels. - I can explain 4624 logon types and find 4688 process creation for a host. - I can write a SIEM search that counts events per user per hour. - I can read SPF, DKIM and DMARC results in a header. - I know who to escalate to, and when, by name. - I have worked at least one practice incident end to end and written it up. - I know how to preserve evidence before I change anything.