How to run a SOC analyst onboarding program with hands-on labs
Most SOC onboarding is a week of slide decks, a tour of the SIEM, and then a new analyst shadowing the queue until someone decides they're ready. You can replace the guesswork with graded reps on real evidence.
New analysts don't learn the queue from a slide deck. They learn it by working alerts, getting them wrong, and having someone show them why. The question for anyone running a SOC is how to get a new hire to that point quickly, and how to know when they're actually ready rather than finished with orientation.
Shadowing is slow, and it doesn't measure anything
The default onboarding is a tour of the SIEM, a read through the runbooks, and then weeks of shadowing a senior analyst until someone is comfortable turning the new hire loose. It works, eventually, but it ties up your most experienced people, it's different for every hire depending on who they sat with and what came through the queue that week, and at the end you have a feeling about whether they're ready, not evidence.
Hands-on labs fix the measurement problem. If every new analyst works the same kind of incident and is graded on it, you can see who can scope a chain and who is still guessing, before they're on a live rotation.
Give every analyst their own incidents
The catch with shared labs is that the second hire hears about the first one's answers. Red Herrings generates a different variant of each case for every person: the hostnames, usernames, IP addresses, timestamps and hashes all come from a seed, so two analysts working the "same" incident are looking at different evidence and arriving at different indicators. A walkthrough passed down from last month's cohort doesn't help, because the flags it names don't exist in this analyst's data.
Ramp from a first alert to a scoped intrusion
Readiness isn't one skill, so onboarding shouldn't be one lab. The incident-response cases run from a single EDR alert you triage and call real or noise, up through a scoped intrusion worked across EDR, SIEM and host logs. A sensible ramp is to start on a First Look alert to learn the console and the vocabulary, move to a medium case that makes them pivot through a SIEM to find the first affected host, then a hard case, a ransomware outbreak worked from the EDR feed, where they have to make the containment call under time. Every case is mapped to MITRE ATT&CK and tagged with the NIST 800-61 phases, so the new analyst is speaking the same language as the rest of the team by the end of week one.
You don't find out whether someone can scope an intrusion by watching them read a runbook. You find out by handing them a noisy console and seeing what they touch first.
Measure readiness instead of guessing it
Because the work is graded, onboarding produces a number instead of a hunch. Grading runs on your machine with sensible tolerances, each question shows why it scored the way it did, and you can run a case as a timed drill through the student portal: the clock starts when the analyst opens their link, answers lock on submit, and the answer key never reaches their browser. A per-question report flags submissions that look alike, so if two hires did compare notes, you'll see it. Run the same drill at the end of onboarding and again a quarter later, and you have a before-and-after on the whole cohort.
It runs on your network, for commercial use
Everything generates and grades locally, so analyst work and your incident scenarios stay on your own machines with nothing to host. The Team plan covers commercial use, up to 100 participants per lab, timed drills and CTF mode, and the Scenario Editor if you want to build onboarding cases around incidents your own team has actually seen.
The First Look cases are free to try, and a 30-day trial opens a set of sample cases. Generate a per-analyst EDR and SIEM incident on your own machine.
