In a simulated Security Operations Center (SOC) environment, performed hands-on alert triage and incident investigation using SIEM and endpoint telemetry data. The lab environment included Splunk SIEM, Sysmon logs, firewall traffic logs, and email security telemetry. I analyzed multiple security alerts involving phishing attempts, suspicious outbound connections, and process activity anomalies.

SOC Investigation Activities:

• Investigated phishing emails and suspicious external domains using Splunk SIEM.
• Correlated email alerts with firewall logs to determine blocked vs allowed user interactions.
• Analyzed network telemetry including IP addresses, URL access attempts, security rules, and connection status.
• Reviewed Sysmon Event ID 1 logs to assess parent-child process relationships and command-line activity.
• Classified incidents as True Positive (Prevented/Escalated) or False Positive based on evidence-driven analysis.