Chapter 1 of 13 · Day 1
The queue, the tools and what to learn first
- What will I actually be doing on my first shift?
- There are so many tools. Which ones matter first?
- Is it normal to understand almost nothing on day one?
Most SOCs run on a queue. Alerts arrive from detection tools, someone picks them up, looks at them, decides what they are and records the decision. On your first shift you will probably not own the queue. You will sit next to someone who does, and watch.
That is the right start. Your job on day one is to build a map, not to close tickets. A good map has three things on it: where alerts come from, where work is recorded, and where you go to look something up.
The three tools to learn first
- The SIEM or log search. This is where you ask questions of the logs. Learn one query that finds every event for a single user or host over the last 24 hours. That one query will carry you through your first month.
- The EDR console. This shows what happened on a laptop or server: processes, network connections, files. Learn how to open a host timeline and how to read a process tree.
- The ticketing or case system. This is where the decision lives after you go home. Learn the fields that are mandatory, the status names and what each one means to the next shift.
Everything else, the SOAR playbooks, the threat intel platform, the email gateway, the cloud consoles, can wait a week. You will touch them, but someone will show you when.
What to write down
- The names of the alert sources and roughly how many alerts each sends in a shift.
- The status names in the case system and who moves a case between them.
- The runbook location, and which alerts have a runbook and which do not.
- The words people use that you do not know yet. Look them up later, or ask at the end of the shift.
The question you might not ask out loud
Is it normal to feel lost on day one?
Yes. Every SOC has its own naming, its own tool stack and its own shortcuts. Nobody arrives knowing them. What people notice is not what you know but whether you write things down and ask the same question only once.
Watch how your buddy decides. Not just what they click, but what they check before they close something. Ask them, after the alert is closed, "what would have made you escalate that?" The answer tells you more about the team than any slide deck.
Rule of thumb:Rule of thumb: on day one, learn to find things, not to judge things. Judgement comes from seeing a few hundred alerts with someone who explains them.