Yohooo! 🚀 Day 2 of my SOC learning journey!

Yohooo! 🚀 Day 2 of my SOC learning journey! Today I focused on understanding the core concepts behind Security Operations Center (SOC) monitoring, detection, and incident response. 🔐 What I learned today: • SOC Workflow — Data Collection → Aggregation → Monitoring & Detection → Analysis → Incident Response • Containment — Isolating a threat to prevent further spread or damage • Eradication — Removing the threat, malicious files, compromised credentials, and addressing the root cause • SOC Triage — Validating alerts, determining severity, gathering information, and prioritizing genuine incidents • Events vs Logs — Understanding what happened vs. the recorded information about what happened • Alerts — Notifications generated when potentially suspicious activity is detected • True Positive vs False Positive — Separating real threats from legitimate activity incorrectly flagged • IOC (Indicator of Compromise) — IPs, domains, file hashes, registry entries, and other evidence that can indicate compromise • Log Management & Log Forwarders — Understanding how security logs are collected and centralized into a SIEM • CIA Triad — Confidentiality, Integrity & Availability • SOC Roles — L1, L2, L3, SOC Manager and SOC Engineer One key takeaway from today: "The goal of a SOC is not just to generate alerts, but to turn security noise into meaningful signals and respond effectively." Still learning, practicing, and building my cybersecurity fundamentals step by step. 💻🔎