SOC Analyst Incident Response Playbook, Explained Through a Fast Food Drive Thru

Bytaisonik

Follow one realistic phishing incident from the first alert to the final lessons learned, and see how a SOC triages, contains, hunts and recovers while the business keeps running. Every step is told through a fast food drive thru at Friday lunch rush, with practical tips for SOC analyst job interviews.

Chapters

  • 0:00 Friday Lunch Rush, Something's Wrong
  • 0:58 Who's Walking You Through This
  • 1:58 Welcome to the Drive Thru
  • 2:31 Part 1: How a SOC Works
  • 3:05 Three Tiers, Three Stations
  • 3:48 Your Two Main Screens: SIEM and EDR
  • 4:35 Trap One: Event, Alert, Incident
  • 5:11 The Playbook: The Card by the Fryer
  • 6:03 Trap Two: Playbook Versus Runbook
  • 6:44 Event, Alert or Incident?
  • 7:03 The Incident Lifecycle in Plain Words
  • 7:44 Severity: The Tray Color
  • 8:25 Part 2: Triage at the Window
  • 9:09 The Payload and the Beacon
  • 9:43 Fifteen Cars Can't Just Wait
  • 10:16 Phase 1: The Order Window
  • 10:48 The Queue and Alert Fatigue
  • 11:34 False Positive or True Positive?
  • 12:15 Checking the Indicators of Compromise
  • 12:59 Burned Toast
  • 13:19 Tier 1 Works Our Case
  • 13:54 Escalate Fast, Write It Down
  • 14:35 Interview Tip: Triage a Phishing Alert
  • 15:15 Part 3: Contain the Damage
  • 15:58 Scoping: How Big Is This?
  • 16:34 Isolate, Don't Destroy
  • 17:12 Why Not Just Pull the Plug?
  • 17:53 Pull the Plug Right Away?
  • 18:12 Close Every Door the Attacker Used
  • 18:56 Keep the Line Moving
  • 19:35 Tier 2 Ticket and Common Mistake
  • 20:17 Interview Tip: Would You Shut It Down?
  • 20:52 Part 4: Hunt and Recover
  • 21:31 Who Else Called the Strange Number?
  • 22:18 PowerShell Doing Strange Things
  • 22:54 Persistence: How Attackers Stay In
  • 23:31 Stolen Keys and Lateral Movement
  • 24:09 Name That Trick
  • 24:28 MITRE ATT&CK: A Shared Language
  • 25:09 Recovery: Clean, Restore, Watch
  • 25:47 Interview Tip: Too Many Alerts
  • 26:27 Part 5: Learn and Improve
  • 27:01 Tuning: The Barcode Scanner
  • 27:45 MTTD and MTTR
  • 28:24 Interview Tip: A Time You Escalated
  • 29:00 Recap: The Whole Drive Thru
  • 29:34 Your Checklist and What's Next

More courses and explainers on the Taistek YouTube channel. New videos every week.

Free download: get my SOC 2 checklist, study guides and ISO 27001 templates at taistek.com/free-resources.

Support the channel

All my courses are free. If this one helped you pass an exam, land a job or get through an audit, a small tip helps me keep making them.

Support on Ko-fi ☕

Similar Posts