Turn a queue of alerts
into verdicts you can prove.

The SOC, its tiers and its clients; the shift, the queue and the log; the analyst's line; the ticket someone else can act on; the tools of the desk; severity and priority; the two lanes.

• What a Tier One security analyst does all day, and for whom
• The analyst's line: triage, investigate, escalate, never remediate, never contact a suspect, never promise
• The ticket someone else can act on, and the line that says what you do not know yet
• Where Nigerian analysts work: banks, fintechs, telecoms and managed SOCs, and what they ask for [NG]

The CIA triad; threat actors in outline; attack surfaces; the kill chain and MITRE ATT&CK; phishing, malware, brute force, web attacks, MFA fatigue and cloud misconfigurations as they appear in the logs.

• MITRE ATT&CK: tactics, techniques and the one id on every Greyfern incident
• Phishing and credential theft: what the email gateway and the identity provider show
• Brute force and password spraying: the pattern in the authentication logs
• MFA fatigue and push bombing

Addresses, ports and DNS; HTTP and TLS in outline; the endpoint agent and the process tree; Windows event ids and Linux auth logs; the identity provider; service accounts; reading, never configuring.

• DNS: what a lookup tells you and what a strange domain looks like
• The process tree: parent, child, and the one that should not be there
• The identity provider: sign-in logs, conditional access and the impossible travel alert
• What Tier One reads and what Tier One never changes on a client system

What a SIEM is and is not; Wazuh from the console; searching and pivoting; saved searches; the second client in Elastic; reading a detection rule and its Sigma rule; noise, tuning and the auto-closure sample.

• Wazuh: the console, the agents, the rule that fired
• Pivoting: from the alert to the user to the host to the hour
• Elastic Security: the same ideas, a different console
• The auto-closure sample: what the platform closed today and why you check it

The four verdicts; the runbook in order; evidence and the chain; the phishing wave; the brute force that is a service account; the AI verdict you validate; the ticket; time to triage; escalations that bounce.

• True positive, false positive, benign true positive, needs Tier 2
• The one that is real: the login from a new country nine minutes after the click
• The AI verdict you validate: the beacon the platform closed as benign
• Escalations that bounce: the 272 in the story and what they lacked

Incident response in outline; containment requested, never executed; the ransomware precursor; the manager who wants a ticket closed; the executive who wants a name; the SIEM outage drill; the six-hour miss reported as it is.

• Containment: what you request, what you never execute
• The manager who says close it, it is our own test
• The SIEM goes down during a live incident: what still works
• A true positive missed for six hours: reporting it as it is

Least privilege and your own access; vulnerability findings as tickets and CVSS read not computed; CBN and the NDPA named for the Lagos SOC, CMMC, NIST 800-171 and SOC 2 named for the US client; evidence never leaves the environment; the analyst as a target.

• Your own access: named account, least privilege, never a shared login
• CBN expectations and the NDPA for the Lagos SOC: why the client has controls and reporting duties [NG]
• CMMC, NIST SP 800-171 and SOC 2: why a US client keeps its telemetry with US-resident staff [US-D]
• Evidence never leaves the environment: the request for logs to a personal email, and the vendor call that wants the console password

The handover and the weekly report; metrics read honestly; the portfolio of simulator work; Security+ SY0-701 and confirming the live exam code before you book; the two markets honestly; interview questions answered with your own tickets; the capstone.

• The weekly report to Yemi, with the metrics read honestly: time to triage, escalation rate, the auto-closure sample
• Security+ SY0-701: the objectives you have already covered, how the exam works, and confirming the live exam code before you book
• The US market for a work-authorised resident: postings, checks, shift work, and the honest sentence [US-D]
• How the capstone is graded, and the ten critical errors

Timed shifts on Greyfern with alerts arriving at realistic rates on both clients, the auto-closure sample every shift, and every ticket graded on its evidence chain and its open questions.

More shifts including the SIEM outage drill, the six-hour miss reported as it is, the request you must refuse, and a tutor-marked capstone. Passing needs zero critical errors.