SOC analyst onboarding labs, one evidence family at a time
A new analyst is expected to recognize every evidence family a ticket can throw at them: what ran on a host, where a file came from, what the Security log says about accounts and services, what's set to run at startup, which USB device was plugged in, what a packet capture shows, what's in memory, and what a phone holds, then to put several of those into a single timeline.
This pathway is the first-look tour in the order a new hire should meet it. Nine First Look cases of about 35 minutes each isolate one artifact family, and the tenth is a full, if gentle, misconduct case that asks the analyst to use several of them together. It's the week-one curriculum we'd hand a new SOC or DFIR analyst.
10 cases · ~6 h 22 min of lab time · Easy to Medium · a different variant for everyone · verified answer keys
The pathway, in order
10 cases, about 6 h 22 min of lab time. Each step opens the case in the library, where you can read the brief, the evidence list and sample questions. Everyone gets a different variant of the same case, graded against a key that was verified in the evidence.
-
01
First Look: What Ran on This Machine
Start with execution artifacts: what ran on a machine.
EASY~33 minUp to 15 questions -
02
First Look: Suspicious Download
Trace a file from the browser that put it there.
EASY~33 minUp to 15 questions -
03
First Look: Accounts and Services in the Logs
Read the security event log for accounts and services.
EASY~35 minUp to 15 questions -
04
First Look: What Runs at Startup
Find what a program set to run at startup.
EASY~33 minUp to 15 questions -
05
First Look: USB Device History
Tie a removable device to a host.
EASY~33 minUp to 15 questions -
06
First Look: Reading a Packet Capture
Open a packet capture and follow a conversation.
EASY~33 minUp to 15 questions -
07
First Look: What's in Memory
Read process and connection lists from a memory image.
EASY~37 minUp to 15 questions -
08
First Look: Recovered Phone
Recover messages from a mobile extraction.
EASY~33 minUp to 15 questions -
09
First Look: Building a Timeline
Bring several artifacts together into one timeline.
EASY~37 minUp to 15 questions -
10
Side Hustle (Employee Misconduct Investigation)
Put it together on a full, if gentle, misconduct case.
MEDIUM~1 h 15 minUp to 20 questions
What this pathway covers
Who it's for
- Security teams onboarding new analysts who want a graded, repeatable first week instead of shadowing.
- Instructors opening a DFIR course who need a survey of evidence types before the deeper units.
- Career changers and students who want to find out which part of DFIR they like before specializing.
What you get with every case
- A different variant per student. Same case, same rubric, different names, hashes, timestamps and answers, so students can talk about method without sharing answers.
- Evidence in the real on-disk format. Registry hives, EVTX, PCAP, SQLite, JSON audit logs and memory images open in the tools the exam expects.
- A verified answer key. Every answer is re-derived from the planted evidence before the lab ships, so grading disputes end at the artifact.
- One-click grading and LMS export. Canvas, Blackboard, Moodle, D2L and LTI 1.3 grade passback, or a CSV. See the student portal.
- Runs on the instructor's machine. Windows installer plus macOS and Linux, fully offline after activation. Nothing to host and no student data leaves the room. Course packs on courses.
Run this pathway with your own roster
Download the app, generate a three-student version of the first case in under five minutes, and grade it. First Look cases run free with no key, and the 30-day trial needs no card. Or open the sample lab first and work a student package in your own tools.
Related pathways
Insider-Threat Investigator
Data theft, snooping and policy violations by people who already had access.
6 cases · ~14 h 9 min
Windows Forensics (GCFE)
Registry, execution, USB, browser and event-log analysis on a Windows host, from first look to a full intrusion.
10 cases · ~17 h 57 min · GIAC GCFE
All learning pathways
Every certification-prep and role pathway across Digital Forensics and Incident Response, side by side.
Browse the overview →
GIAC, GCFE, GASF, GNFA, GCIH, GCFR and GCFA are trademarks of GIAC. CompTIA and CySA+ are trademarks of CompTIA, Inc. SANS is a trademark of the SANS Institute. Red Herrings aligns its pathways to the published objectives of these programs for teaching; it's independent of, and not affiliated with or endorsed by, any certification body.