SOC Analyst Fundamentals: How to Get Hands-On Experience with a Live SIEM

Most SOC training begins with canned data and a prewritten answer. That is not what the job feels like.
In this live session, we will investigate real attack traffic in a Splunk environment connected to a honeypot. You will see how an alert becomes an analyst decision, what evidence matters, and how to explain your conclusion.
🎯 What we'll cover
• What a SOC analyst does with an alert queue and where the role fits on a security team
• How to read an alert, separate signal from noise, and write a clear disposition note
• A practical look at the SPL queries and investigative habits that support the work
• How traffic reaches a honeypot and surfaces in the SIEM
Bring your questions. A student handout will be shared during the session and refined after the replay transcript is available.
After the session
Continue with Cover6: First Watch, the free practical primer for SOC Analyst Prep:
https://www.cover6solutions.com/product/cover6-first-watch-free-access/
Keep practicing with Cover6 Community and the monthly CTF:
https://play.cover6solutions.com/