SOC Role in Blue Team — THM Writeup

SOC Role in Blue Team is a theory room that places the SOC within an organization, explains what the Blue Team does, how SOC roles are structured, and how an L1 analyst can advance their career. It blends concepts (org structure, responsibilities) with practical career advice (skills, next roles, internal SOC vs MSSP).

Platform	TryHackMe
Category	Blue Team & SOC
Difficulty	Easy
Room	SOC Role in Blue Team

1. What is the Blue Team

The Blue Team is the defensive crew: the people and processes that detect, respond to, and limit damage from attacks. They operate the Security Operations Center (SOC), build detections, tune tools, and collaborate with other security teams (GRC, Red Team, CIRT). Their job is to keep attackers out, spot them fast when they get in, and remediate effectively.

Q: Does Blue Team focus on defensive or offensive security?
A: Defensive

2. Where the SOC sits in company structure

Large organizations usually route security decisions to a CISO (Chief Information Security Officer). The CISO oversees departments like SOC (Blue Team), Red Team, GRC, AppSec, and Incident Response. SOC analysts (technical staff) report to a SOC manager, who reports to a director or the CISO depending on the org.

Q: Which senior role typically makes key cyber security decisions?
A: CISO

Q: What is the common name for roles like SOC analysts and engineers?
A: Blue Team

3. SOC team composition

A typical SOC includes:

L1 Analysts: junior triage. Review alerts, do initial enrichment, and escalate to L2 if needed.
L2 Analysts: deeper investigations, threat hunting, playbook execution, and complex triage.
Engineers: tune and maintain the tools (SIEM, EDR), create detection rules, and automate tasks.
Manager: operational oversight, staffing, and KPIs.

Outside the SOC, a CIRT/CSIRT handles full-scale incidents and forensics.

Q: Which department handles active or urgent cyber incidents?
A: CIRT

4. Internal SOC vs MSSP

Two environments to work in; both teach valuable skills but differ in pace and exposure:

Internal SOC: focus on one organization. You learn depth (business context, specific tech stack). Shifts can be calmer.
MSSP (Managed Security Service Provider): monitor many customers and tech stacks. Fast-paced, lots of variety, and a steep learning curve early on (great for exposure and experience).

Q: How would you call a cyber security company providing SOC services?
A: MSSP

5. The career ladder and how to progress

Typical progression: L1 Analyst → L2 Analyst → Threat Hunter/Incident Responder or SOC Engineer → Manager → Director/CISO. But routes vary: some move sideways into AppSec, Forensics, or DevSecOps. Key early goal: get real incident-handling experience and learn to think like an attacker.

Practical tips to advance:

Master the fundamentals: TCP/IP, Windows/Unix internals, basic scripting.
Learn your tools: SIEM queries, EDR triage, network captures.
Get certifications (helpful early ones: CompTIA Security+, Splunk fundamentals, CEH; later: OSCP, GIAC certs).
Practice: CTFs, home lab, threat hunts.
Document and communicate: write clear incident notes and playbooks.

Q: Which role naturally continues your SOC L1 analyst journey?
A: SOC L2 Analyst

6. Day in the life of an L1

A typical L1 shift includes:

Reviewing SIEM/EDR alerts and tickets.
Performing initial enrichments (WHOIS, VirusTotal, process/parent checks).
Escalating validated incidents to L2/CIRT.
Updating the ticket with evidence and remediation suggestions.
Attending handover and daily standups.

Pro tip: produce reproducible steps for L2 so they don't waste time redoing initial work.

7. Specialised Blue Team roles

As you gain experience, you can specialize:

Threat Intelligence Analyst: tracks threat actors and TTPs.
Digital Forensics Analyst: deep disk and memory analysis.
AppSec/DevSecOps: integrate security into the SDLC.
AI Security Researcher: defensive models and adversarial ML.

Specialization often follows broad experience in SOC or CIRT.

8. Four golden rules for SOC analysts

Learn from every alert. Each alert is a lesson.
Think like an attacker. Ask: how would I bypass detection?
Verify everything. Don't assume; evidence matters.
Get involved. Volunteer for hunts, write-ups, or tool automation.

9. Final challenge

The room's final interactive challenge places you in the CISO chair, assigning roles to incidents. It tests your understanding of which team should respond to each incident type (SOC, CIRT, Red Team, etc.). Completing it yields the room's flag.

Q: What flag did you claim after completing the final challenge?
A: [FLAG HIDDEN]

10. Quick career checklist

Must-have skills: networking, OS internals, SIEM queries, EDR basics, scripting (Python/Bash/PowerShell), incident reporting.

Nice-to-have: malware basics, forensics, threat intel, cloud security, logging pipelines.

Certs to consider: Security+, Splunk fundamentals, Azure/AWS security fundamentals, then GIAC/OSCP as you specialize.

Daily habit: read one security blog, play one challenge, document one lesson.

Key takeaways

The Blue Team is defensive and operates the SOC; the CISO leads high-level security decisions.
SOC roles scale from L1 (triage) to L2 (investigation), backed by engineers and managers, while the CIRT handles urgent incidents.
An internal SOC gives depth within one organization; an MSSP gives breadth and pace across many customers.
The L1 → L2 → hunter/IR or engineer → manager → director/CISO path is not rigid: lateral moves into AppSec, forensics, or DevSecOps exist.
You progress through solid fundamentals, tool mastery, certifications, steady practice, and clear documentation.

2. Dónde encaja el SOC en la estructura de la empresa

Las organizaciones grandes suelen canalizar las decisiones de seguridad hacia un CISO (Chief Information Security Officer). El CISO supervisa departamentos como SOC (Blue Team), Red Team, GRC, AppSec e Incident Response. Los analistas SOC (personal técnico) reportan a un SOC manager, que a su vez reporta a un director o al CISO según la organización.

Q: Which senior role typically makes key cyber security decisions?
A: CISO

Q: What is the common name for roles like SOC analysts and engineers?
A: Blue Team

3. Composición del equipo SOC

Un SOC típico incluye:

Analistas L1: triage junior. Revisan alertas, hacen enriquecimiento inicial y escalan a L2 si hace falta.
Analistas L2: investigaciones más profundas, threat hunting, ejecución de playbooks y triage complejo.
Ingenieros: afinan y mantienen las herramientas (SIEM, EDR), crean reglas de detección y automatizan tareas.
Manager: supervisión operativa, dotación de personal y KPIs.

Fuera del SOC, un CIRT/CSIRT gestiona los incidentes a gran escala y el análisis forense.

Q: Which department handles active or urgent cyber incidents?
A: CIRT

4. SOC interno vs MSSP

Dos entornos donde trabajar; ambos enseñan skills valiosas, pero difieren en ritmo y exposición:

SOC interno: foco en una sola organización. Aprendes profundidad (contexto de negocio, stack tecnológico concreto). Los turnos pueden ser más tranquilos.
MSSP (Managed Security Service Provider): monitorizas muchos clientes y stacks. Ritmo alto, mucha variedad y curva de aprendizaje pronunciada al principio (ideal para exposición y experiencia).

Q: How would you call a cyber security company providing SOC services?
A: MSSP

5. La escalera profesional y cómo progresar

Progresión típica: L1 Analyst → L2 Analyst → Threat Hunter/Incident Responder o SOC Engineer → Manager → Director/CISO. Pero las rutas varían: algunos se mueven lateralmente hacia AppSec, Forensics o DevSecOps. Objetivo temprano clave: conseguir experiencia real de manejo de incidentes y aprender a pensar como un atacante.

Consejos prácticos para avanzar:

Domina los fundamentos: TCP/IP, internals de Windows/Unix, scripting básico.
Aprende tus herramientas: queries de SIEM, triage de EDR, capturas de red.
Obtén certificaciones (útiles al principio: CompTIA Security+, Splunk fundamentals, CEH; más adelante: OSCP, certs GIAC).
Práctica: CTFs, laboratorio en casa, threat hunts.
Documenta y comunica: escribe notas de incidente y playbooks claros.

Q: Which role naturally continues your SOC L1 analyst journey?
A: SOC L2 Analyst

6. Un día en la vida de un L1

Un turno típico de L1 incluye:

Revisar alertas y tickets de SIEM/EDR.
Realizar enriquecimientos iniciales (WHOIS, VirusTotal, comprobaciones de proceso/padre).
Escalar incidentes validados a L2/CIRT.
Actualizar el ticket con evidencias y sugerencias de remediación.
Asistir al handover y a los daily standups.

Pro tip: produce pasos reproducibles para L2 para que no pierdan tiempo rehaciendo el trabajo inicial.

7. Roles especializados de Blue Team

Con experiencia puedes especializarte:

Threat Intelligence Analyst: rastrea actores de amenaza y TTPs.
Digital Forensics Analyst: análisis profundo de disco y memoria.
AppSec/DevSecOps: integra la seguridad en el SDLC.
AI Security Researcher: modelos defensivos y adversarial ML.

La especialización suele venir después de una experiencia amplia en SOC o CIRT.

8. Cuatro reglas de oro para analistas SOC

Aprende de cada alerta. Cada alerta es una lección.
Piensa como un atacante. Pregúntate: ¿cómo evadiría yo la detección?
Verifica todo. No asumas; la evidencia importa.
Implícate. Ofrécete para hunts, write-ups o automatización de herramientas.

9. Reto final

El reto interactivo final del room te sienta en la silla del CISO, asignando roles a incidentes. Pone a prueba si entiendes qué equipo debe responder a cada tipo de incidente (SOC, CIRT, Red Team, etc.). Completarlo te da la flag del room.