InternshipAll 30 tasks, level by level
The real graded SOC & SIEM tasks the portal assigns, grouped into three levels.
The portal assigns these SOC & SIEM tasks. Finish Level 1 before Level 2 and Level 2 before Level 3. Your mentor may mark some tasks as required for the certificate.
Level 1: Foundations (12 tasks)
| Task | What to do |
|---|---|
| What a SOC does | In a repo named soc-internship, explain what a Security Operations Centre does, the L1/L2/L3 analyst roles and the CIA triad, with examples. |
| Build a home lab | Set up a lab with VirtualBox or VMware: one Windows VM, one Linux VM and a SIEM VM. Draw the lab network. |
| Windows event logs | Find and explain Windows Event IDs 4624, 4625, 4688, 4720 and 1102 in Event Viewer on your lab machine. |
| Linux logs | Read /var/log/auth.log (or journalctl) and find failed SSH logins, sudo use and new users. Explain each entry. |
| Install a SIEM | Install Wazuh, Splunk Free or Elastic Security in your lab and send logs from both VMs. Show the logs arriving. |
| Search logs | Write 10 SIEM searches: failed logins, logins at night, new admin users, PowerShell runs and more. Save the queries. |
| Network traffic basics | Capture traffic with Wireshark while browsing and explain DNS, the TCP handshake, HTTP and TLS packets you see. |
| Phishing email analysis | Analyse 3 sample phishing emails (from public training sets): headers, sender, links and attachments. Write the warning signs. |
| IOC lookups | Check sample IPs, domains and file hashes on VirusTotal and AbuseIPDB and write what each result means. |
MITRE ATT&CK | Map 5 attack techniques (phishing, brute force, PowerShell, persistence, data exfiltration) to MITRE ATT&CK IDs and explain how each is detected. |
| Incident ticket | Write an L1 ticket for a brute-force alert: summary, evidence, severity, actions taken and escalation decision. |
| Sysmon | Install Sysmon with a community config on the Windows VM and show process creation and network connection events in the SIEM. |
Level 2: Building real features (10 tasks)
| Task | What to do |
|---|---|
| Brute-force detection | Run a controlled brute-force (Hydra against your own lab VM only), then build a SIEM alert rule that catches it. |
| Suspicious PowerShell | Run harmless encoded PowerShell commands in the lab and write a detection for encoded or download-and-run commands. |
| Detection rules as code | Write 5 Sigma rules for your lab detections, convert them for your SIEM and keep them in Git with test notes. |
| Dashboards | Build a SOC dashboard: logins by user, failed logins over time, top source IPs and alerts by severity. |
| Malware triage | Examine a safe sample from a training set (or the EICAR test file) with hashing, strings and an online sandbox report. Write a short triage note. |
| Network detection | Install Suricata or Zeek in your lab, run a port scan with Nmap against your own VM and show the alert. |
| Threat intelligence | Add a free threat-intel feed (abuse.ch lists or AlienVault OTX) to your SIEM and alert when a known bad IP appears. |
| Alert triage practice | Investigate 10 alerts from a public SOC dataset or Blue Team Labs or LetsDefend free challenges. Mark each true or false positive with reasons. |
| Playbook | Write an incident response playbook for a phishing report: steps, tools, who to tell and when to close. |
| Reduce false positives | Tune one noisy rule in your SIEM with exclusions or thresholds and show the alert count before and after. |
Level 3: Professional work and capstone (8 tasks)
| Task | What to do |
|---|---|
| Full incident simulation | Simulate an attack chain in your lab (phishing file, PowerShell, new user, data copy), detect each step and write a timeline. |
| Incident report | Write a professional incident report for the simulation: executive summary, impact, timeline, root cause, IOCs and recommendations. |
| Automate a response | Automate one response with a script or SOAR tool (Shuffle or TheHive): for example, block an IP or open a ticket when an alert fires. |
| Threat hunting | Form a hypothesis (for example 'an attacker uses scheduled tasks for persistence'), hunt for it in your logs and report the findings. |
| Cloud logs | Send logs from a free cloud account (AWS CloudTrail, Azure Activity Log or Google Cloud audit logs) to your SIEM and detect a risky change. |
| Metrics and coverage | Measure your SOC lab's MTTD and MTTR from the simulations and show your detection coverage on the ATT&CK matrix. |
| Ethics and law | Write a page on legal and ethical rules for SOC work in India: the IT Act, the DPDP Act, CERT-In reporting within 6 hours and testing only with permission. |
| Capstone: SOC portfolio | Publish your SOC lab: architecture, 10 or more detections with tests, dashboards, playbooks and one full incident report. Submit the repo and a 2-minute video walkthrough. |