Transcription
In this video, I'll be going over a day in the life of a sock analyst working at a managed security service provider, also known as an MSSP, and the things you must do to take advantage of that environment.
Over the years, I've had the privilege of working in many sock environments, especially at MSSPs. I went from a tier one analyst all the way to a tier three analyst, and believe me, it gets hectic really quick.
Now, some socks may differ; however, the majority of them do follow a similar structure. Tier 1 analysts are typically the junior analysts who are responsible for monitoring a ticketing queue and triaging alerts. Tier 2 analysts help the tier ones in their investigations if needed, whereas tier 3 analysts focus on more specific skills such as cyber threat intelligence, threat hunting, incident response, use case creation, tuning, and many more.
But today, I'll be talking about the day in the life of a tier 1 security operations analyst. When working in a sock, expect to work weird schedules. Some schedules may have four days on, four days off, five days on, three days off, or the usual five days on and two days off. Each organization is different, but do expect to work odd hours, especially the night shift.
So, when you're working in a sock environment, it is very process-driven, meaning you will likely have to follow the process to a T. If you deviate just a little from that, you might get in trouble. Generally, you'll be monitoring a ticketing queue, whether that be ServiceNow, a SOAR platform, or even email.
Hopefully, the alerts that show up in that ticketing queue actually have some details like host names, IPs, usernames, and all that good stuff. Now, I say hopefully because I've seen some alerts that have little to no information. That's never a good time.
But anyways, for this example, let's just say you're monitoring your inbox for a new alert. When a new alert triggers and arrives in your inbox, what you want to do is take a look at it and see if anybody else is working on a similar alert. If not, you go and cut a ticket with whatever ticketing system you're using.
From there, you jump into your security tools such as a SIM, EDR, network, if you're fancy, XDR, and start triaging the alert. Depending on the available information that your security solutions provide, you might have to resort to open source intelligence. You'll likely be using the Holy Grail of the sock, which is VirusTotal. I swear, without VirusTotal, half the sock will be in shambles.
So, after triaging the alert, going through your security tools, and going through open source intelligence, you eventually gather all the information you need and come to a verdict. Now, if you don't understand or know what to look for, that is where the tier 2 comes in to help you with the investigation.
There will definitely be a point where you receive a bunch of alerts, and I mean a bunch of alerts, like a hundred plus. This may be a sign of an attack, but more often than not, it's likely a use case that was enabled too early without testing because all PowerShell is evil.
When this happens, and obviously it depends on the process, you typically open up a ticket and assign it to the tier 3 analyst or whoever is responsible for tuning that alert.
So, in summary, what exactly does a tier 1 working at a security operations center do? Well, number one, monitor the queue. No matter what, your main focus will be monitoring a queue to look for any new alerts that come up.
Number two, when an alert triggers, you want to assign that alert to yourself. That way, you let the other sock analysts know that you're taking a look into it. Side note: if you get bombarded by a lot of alerts, try and find out why. It could be a false positive or another alert that was enabled too quickly without testing, and if that's the case, you follow the process and go from there.
Number three, after taking a look at previous similar alerts, you can start going into your security tools again. That is your SIM, EDR, network, XDR, whatever is available to you, and start investigating. Again, you will likely be using some open source intelligence tools to identify additional information and eventually come to a conclusion.
Now, if you're not entirely sure what to look for or know how to investigate the alert, again, the tier 2 is there to help you with that.
Number four, once you come up with a conclusion, whether that be a false positive or true positive, you assign the ticket accordingly. Now, whether that ticket is closed due to a false positive or maybe assigned to a tier three for incident response, again, very process-driven, follow your process.
Step number five, you rinse and repeat, and there you have it: the life of a tier 1 security operations analyst.
Now, what exactly can I do to take advantage of that environment? Keep in mind, when working as a tier 1 security operations analyst in an MSSP environment, or what I like to call a sink or swim environment, it can get hectic really quickly.
But I don't want you to get discouraged by it. Instead, I want you to jump right in and go for it. Sink or swim environments tend to be extremely fast-paced, and if you fall behind, it is actually very noticeable.
Now, again, don't be discouraged by this. Instead, jump in and start playing with a bunch of tools. MSSPs are great for exposing new analysts to new tools. However, to take advantage of this environment, there is one thing you need to keep in mind: do not be scared of taking on a new alert.
I want to share with you a real-life example of this. One day, a new alert triggered, and the analysts did their thing. They took a look at previous alerts just to see if there was anything similar, and lo and behold, they froze. From there, the alert was not touched.
The purpose of the story is to let you know that there are going to be times when a new alert triggers that nobody has touched before. Try not to be the person that is scared to take on that alert. Instead, if you don't understand the alert, ask the tier 2 and 3 analysts. Typically, they are very smart people and should be able to walk you through their thought process and help you with the investigation.
Now, don't get me wrong; there are going to be times when you might get intimidated by a new alert, and that is completely fine. What I encourage new analysts to do is try and find out why. Is it because you might lack a certain set of skills?
What you can do is start exposing yourself to lab work. From there, you will be able to gain more hands-on experience and build more confidence in your skills. If that doesn't cut it, you can supplement that with additional studying. That way, you can understand the concept and, again, be more confident.
By doing this, you will become a better analyst very quickly. Understand the skills that you lack and actually do something about it. This will make you grow as an analyst compared to those who are intimidated and only work on the alerts that were done previously.
So, I want you to take your time, understand, and embrace all of the new alerts that come into your queue and all of the tools that you'll be touching.
Well, that is it for this video, and I hope you found that informative. If you enjoyed this video, let me know by hitting that like button and subscribe if you want to.