root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to TryHackMe writeups
root@sparrow:~/writeups$ cat junior-security-analyst-intro.md
// Blue Team & SOC

Junior Security Analyst Intro

13 May 2024 · 6 min read
Blue Team & SOCwriteupstryhackmeEasy
Junior Security Analyst Intro is a theory-and-triage room that introduces the SOC Level 1 role. It defines what a Junior (Associate) Security Analyst does day to day, then drops you into a mock alert console to practice the core triage loop: spot the malicious indicator, verify its reputation, escalate to the right person, and contain it by blocking the offending IP.
PlatformTryHackMe
CategoryBlue Team & SOC
DifficultyEasy
RoomJunior Security Analyst Intro (SOC Level 1)

Task 1 — A career as a Junior (Associate) Security Analyst

The Junior Security Analyst sits at the front line of the SOC as a Triage Specialist. This is the L1 tier: the analyst who first lays eyes on incoming alerts, decides what is real versus noise, and pushes anything meaningful up the chain. Typical day-to-day responsibilities include:

  • Monitoring and investigating alerts from the SIEM and other sensors.
  • Managing and operating the SOC tooling.
  • Writing basic IDS/IPS signatures to catch known-bad activity.
  • Escalating to Tier 2 analysts or the Team Lead when an incident exceeds L1 scope.

Q: What will be your role as a Junior Security Analyst?
A: Triage Specialist

Task 3 — A day in the life: alert handling, IP check, escalation, containment

The room's View Site button opens a mock SIEM / alert console. It walks you through the full L1 triage loop end to end, so the goal is to internalize the sequence rather than any single answer: identify → verify → escalate → contain.

Step 1 — Identify the malicious indicator

The alert fires on an unauthorized connection attempt. Reading the alert details surfaces the source address behind the activity, which is the indicator you will carry through the rest of the investigation.

Q: What was the malicious IP address in the alerts?
A: 221.181.185.159

Step 2 — Verify the threat reputation

Never act on an indicator blindly — enrich it first. The room provides an IP Scanner widget; feeding it 221.181.185.159 returns a malicious verdict. In a real SOC you would query threat-intel and reputation sources to reach the same conclusion. Equivalent real-world commands:

# AbuseIPDB (replace $API_KEY and confirm ToS)
curl -G https://api.abuseipdb.com/api/v2/check --data-urlencode "ipAddress=221.181.185.159" -d maxAgeInDays=90 -H "Key: $API_KEY" -H "Accept: application/json"

# Whois lookup
whois 221.181.185.159

# Passive DNS / reverse lookup
dig -x 221.181.185.159 +short

Step 3 — Escalate appropriately

Once the indicator is confirmed malicious, an L1 analyst does not sit on it — they escalate to the right person so the incident gets ownership. In this scenario you escalate the event to the SOC Team Lead.

Q: To whom did you escalate the event associated with the malicious IP address?
A: Will Griffin

Step 4 — Contain by blocking the IP

Containment stops the bleeding. Using the room's Block IP control on 221.181.185.159 drops the connection at the firewall and reveals the final flag — a parting message from the actor. Equivalent real-world blocks (examples; do not run blindly in production):

# Linux nftables
sudo nft add table inet filter
sudo nft add chain inet filter input { type filter hook input priority 0 ; }
sudo nft add rule inet filter input ip saddr 221.181.185.159 drop

# Linux iptables
sudo iptables -A INPUT -s 221.181.185.159 -j DROP

# UFW (Ubuntu)
sudo ufw deny from 221.181.185.159

# Palo Alto (CLI example concept)
set address 221_181_185_159 ip-netmask 221.181.185.159/32
set address-group Blocked_IPs static 221_181_185_159
commit

# Cisco ASA
access-list OUTSIDE-IN extended deny ip host 221.181.185.159 any
access-group OUTSIDE-IN in interface outside

# Windows Defender Firewall (PowerShell)
New-NetFirewallRule -DisplayName "Block 221.181.185.159" -Direction Inbound -RemoteAddress 221.181.185.159 -Action Block

Q: After blocking the malicious IP address on the firewall, what message did the malicious actor leave for you?
A: THM{UNTIL-WE-MEET-AGAIN}

Key takeaways

  • The Junior Security Analyst is the SOC's L1 Triage Specialist: monitor alerts, run tooling, write basic signatures, and escalate what matters.
  • Triage follows a repeatable loop — identify the indicator, verify its reputation, escalate to the right owner, then contain.
  • Enrich before you act: reputation and threat-intel lookups (AbuseIPDB, whois, passive DNS) turn a raw IP into a decision.
  • Containment is concrete: a firewall block (nftables, iptables, UFW, Palo Alto, Cisco ASA, or Windows Firewall) cuts the malicious source off at the perimeter.