1. Escalation Handling & Validation
Objective: Confirm or dismiss incidents
escalated by L1
-Receive escalated tickets
-Requalify (priority, impact, criticality)
-Validate malicious activity
-Detect complex false positives
---
2. Advanced Investigation (Deep Analysis)
Objective: Precisely understand the
attack
In-depth multi-source log analysis:
-Endpoint (EDR)
-Network (NDR)
-Identity (AD / IAM)
-Cloud (SaaS / IaaS)
-Advanced event correlation
-Full timeline
reconstruction
-Identification of initial access
-Analysis of lateral movement
---
3. Threat Analysis & Contextualization
Objective: Understand WHO is attacking
and HOW
-MITRE ATT&CK mapping
-Identification of techniques used
-Correlation with known campaigns
-Advanced Threat Intelligence enrichment
Examples:
-Known malware?
-APT group?
-Ongoing phishing campaign?
---
4. Incident Response (Containment &
Remediation)
Objective: Effectively stop the attack
-Define response strategy
-Advanced containment:
-Full network isolation
-Global blocking (firewall, EDR, proxy)
-Revocation of compromised accounts
-Supervise L1 / IT actions
---
5. Malware & Suspicious File Analysis
Objective: Understand malicious files
-Static analysis:
-Hash, strings, signatures
-Dynamic analysis:
-Sandbox
-Identification of malware behavior
---
6. Complex Incident Management
Objective: Lead the incident end-to-end
-Full tracking of critical incidents
Coordination with:
-IT
-Network
-Management
-Real-time communication
-L2 becomes the technical lead (orchestrator)
---
7. Use Case Creation & Improvement
Objective: Enhance detection
capabilities
-Create new SIEM / EDR rules
-Optimize existing rules
-Reduce false positives
-Develop TTP-based detections
---
8. Automation & Playbooks (SOAR)
Objective: Accelerate response
-Create / improve playbooks
-Automate repetitive tasks
-Validate SOAR workflows
Examples:
-Automatic malicious IP blocking
-Automated alert enrichment
---
9. Technical Reporting & Post-Incident
Analysis
Objective: Learn from incidents
-Write detailed technical reports
-Conduct post-mortem analysis (lessons learned)
-Identify exploited vulnerabilities
-Provide security recommendations
---
10. SOC L1 Support & Mentoring
Objective: Raise overall SOC capability
-Provide technical support to L1 analysts
-Validate their investigations
-Deliver continuous training
---
11. Threat Monitoring & Active Intelligence
Objective: Anticipate attacks
-Monitor new vulnerabilities
-Track emerging attack techniques
-Adapt SOC detection rules
---
12. Forensics & Evidence Collection (Basic to
Intermediate)
Objective: Prepare advanced
investigations
-Collect artifacts:
-Logs
-Memory (if possible)
-Suspicious files
-Preserve evidence integrity
Copyright © All rights reserved.