Automation & core tools soc

Automation & core tools soc

1.python

. parse logs.call APIs, automate and data transformations

2.power shell

.windows investigation: query logs, enumerate service,automate evidence collection

3. suricate

.IDS engine for network detection — learn rule writing and turning

4. sysmon

.rich windows telemetry: process create, network connections,file events

5. bash

.quiry shell scripts and text processing with grep , awk , sed.pipes

6. wireshake

.packet-level analysis to confirm data exfiltration or suspicious sessions

7. splunk/ELK/Wazuh

.ingest, search, and correlate logs: dashboards and detections are core soc

8. Virus Total/AbuselPDB

.fast enrichment sources for file and ip reputation checks during triage