Build this project step by step
Complete the following activities and document your decisions. Modify the scope based on your tools and experience.
01
Step 1
Create isolated practice VMs or a dedicated approved test machine.
02
Step 2
Install Sysmon and a log collection stack following the vendors’ documentation.
03
Step 3
Generate benign test events, such as a new scheduled task or unusual test process.
04
Step 4
Search and annotate the resulting logs; build a simple detection query.
05
Step 5
Produce a short incident report and MITRE ATT&CK mapping where relevant.
What to show in your portfolio
A portfolio-ready SOC case study showing investigation methods and responsible lab design.
- Problem statement and intended audience
- Technology selection and architecture
- Implementation screenshots or repository
- Testing, security and limitations
- What you would improve next