Tools and first-week setup

The tools a SOC & SIEM intern uses and how to set up your workspace in week one.

These are the main tools for SOC & SIEM tasks. You do not need all of them on day one; the Level 1 tasks tell you when to install each one.

Set up your workspace

Create a free GitHub account if you do not have one, with a professional username, and set up your LinkedIn profile: every task is submitted with a LinkedIn post.
Create one repository for the internship, for example soc-and-siem-internship, with a README that says who you are and what the repo holds.
Keep one folder per task, named with the task number and title, so mentors find your work quickly.
Commit small changes every day with clear messages. Your daily work report uses these commits as proof.
Never commit passwords, API keys or personal data. Put secrets in a .env file and add it to .gitignore.

Task	What to do
What a SOC does	In a repo named soc-internship, explain what a Security Operations Centre does, the L1/L2/L3 analyst roles and the CIA triad, with examples.
Build a home lab	Set up a lab with VirtualBox or VMware: one Windows VM, one Linux VM and a SIEM VM. Draw the lab network.
Windows event logs	Find and explain Windows Event IDs 4624, 4625, 4688, 4720 and 1102 in Event Viewer on your lab machine.
Linux logs	Read /var/log/auth.log (or journalctl) and find failed SSH logins, sudo use and new users. Explain each entry.