What a SOC & SIEM intern does

The SOC & SIEM role, what you build at each level and what you need before you start.

Train as a SOC analyst in your own lab: Windows and Linux logs, SIEM searches and dashboards, Sysmon, detection rules, alert triage, phishing analysis, MITRE ATT&CK, threat hunting and incident reports.

What you build, level by level

Level 1: Foundations: What a SOC does, Build a home lab, Windows event logs and more.
Level 2: Building real features: Brute-force detection, Suspicious PowerShell, Detection rules as code and more.
Level 3: Professional work and capstone: Full incident simulation, Incident report, Automate a response and more.

Where this work is used

Training Trains, W3AppDevelopers and DomainHostly use these skills in real projects: Cyber Security. Interns who pass the readiness check can take paid-company work from the Company Work board in the portal.

Before you start

Basic networking and Linux help. A laptop with 16 GB RAM is best for the lab; 8 GB works with smaller VMs. All attacks are run only against your own lab.

Tools and first-week setup →