Cyber Security Task 2

🛡️ Security Operations Center (SOC) Internship Task: Security Alert Monitoring & Incident Response Simulation

🔍 About the Task
In this internship project, you’ll get a beginner-friendly introduction to the core activities of a Security Operations Center (SOC). Your main role will be to monitor security alerts, analyze potential threats, and simulate incident response — just like a SOC analyst in a real company.

This project simulates what SOC teams do 24/7 to keep organizations safe from cyberattacks by detecting suspicious activities early and responding quickly.

✅ What You’ll Do

• Set up and explore a free or demo SIEM tool (Security Information and Event Management) like Elastic Stack (ELK) or Splunk Free Trial
• Analyze incoming security alerts and logs (simulated data provided)
• Identify suspicious activities such as failed logins, unusual IP addresses, or malware alerts
• Categorize and prioritize alerts based on severity
• Draft an incident response report outlining the threat, impact, and suggested next steps
• Simulate communication with stakeholders about the incident
• Learn how SOC teams track and manage threats using dashboards and playbooks

🎯 Skills You’ll Gain

• Basic log analysis and alert triage
• Understanding of SIEM tools and dashboards
• Incident classification and escalation process
• Cybersecurity terminology and threat identification
• Effective incident communication and reporting

🛠️ Tools You’ll Use

• Elastic Stack (ELK) – Open-source SIEM for ingesting and analyzing logs (Elastic.co)
• Splunk Free Trial – Powerful SIEM platform (Splunk.com)
• Sample alert logs (provided by internship mentors)
• Google Docs or Word – To write your incident response report

📁 Sample Data Provided

1. Simulated system logs with event timestamps
2. Network connection logs showing IP addresses
3. Authentication logs including successful and failed login attempts
4. Malware detection alerts

🎓 Tutorial to Get Started (for Reference)
🔗 Video: Intro to SIEM and Log Analysis for Beginners
This video explains how to use a SIEM tool to monitor and investigate security alerts step-by-step.

🔑 Key Features to Include
✔ Ability to identify 3–5 suspicious alerts from logs
✔ Incident classification by priority (High, Medium, Low)
✔ Detailed incident response report with timeline, impact, and remediation suggestions
✔ A summary dashboard screenshot from the SIEM tool
✔ (Optional) A communication email template reporting the incident to management

📝 Final Deliverables

• Incident Response Report (PDF or Doc)
• Screenshots of analyzed alerts and SIEM dashboard
• Alert classification log or spreadsheet
• (Optional) Email communication draft