Advanced reference guide for every level of SOC analyst

This documentation is designed to serve as a direct investigation reference and guide for all three tiers of analysts in a SOC, including L1, L2, and L3.

The standout feature of this playbook is its highly comprehensive scope, covering a total of 229 attacks scientifically classified into 30 threat categories commonly found in cyberspace.  

The categorization covers core aspects of modern cybersecurity:  

• Email Security and Identity: Various forms of phishing from basic to advanced (Phishing & Email, Advanced Email Security), as well as attacks targeting accounts and credentials (Identity & Credentials).  

• Infrastructure and Endpoints: Malware and endpoint security (Malware & Endpoint), network threats and lateral movement (Network & Lateral Movement), and Active Directory & Kerberos environments.  

• Modern Tech and Cloud: Web application security (Web & Application), Cloud computing and SaaS services (Cloud & SaaS), Container & DevOps ecosystems, up to emerging threats related to Artificial Intelligence (AI & Emerging).  

• Other Specialized Scenarios: Attacks on APIs, databases, industrial control networks and smart devices (OT/ICS/IoT), supply chains (Supply Chain), alongside specialized evasion, privilege escalation, insider threats, and ransomware tactics (Ransomware TTPs, Social Engineering, Defense Evasion, Persistence, Privilege Escalation).  

www.ipsip.vn

10 Practical SOC Analyst Projects to Upgrade Your CV in 2026

Do you want to become a SOC Analyst but don't know which projects to undertake? This article summarizes 10 hands-on SOC Analyst projects, ranging from SIEM and Incident Response to Threat Hunting, to help you enhance your skills and boost your job application resume.

Standardized and detailed investigation playbook structure

Instead of merely listing threats, each specific attack type across the 229 scenarios is meticulously broken down into a uniform, standardized structure. This allows analysts to immediately look up and execute actions without hesitation:  

• Severity: Defines the priority level to allocate response resources efficiently.  

• What it looks like: Visually describes how the attack manifests or what system alerts are recorded.  

• Hierarchical checks (L1/L2/L3 Checks): Provides clear guidance on initial sorting for L1 staff, deep analysis for L2, and widespread incident response workflows for L3 or Incident Response (IR) teams.  

• Classification signals (TP/FP/BP signals): Offers explicit instructions to differentiate between an actual attack (True Positive), a legitimate or simulated alert (False Positive), or a real threat that was successfully blocked by security controls (Benign/Blocked Positive).  

• Isolation and Mitigation (Containment): Urgent technical actions aimed at minimizing the impact and blst radius of the incident.  

• Digital Forensics (Forensics): Specifies the exact data sources, forensic images, or log files required to be gathered and preserved for deep post-incident analysis.  

Scientific hierarchical triaging process

To optimize incident response time, the documentation establishes a clear triaging process based on 4 primary severity levels:  

Severity Level	Required Action
Critical	Immediately activate the Incident Response plan (Critical immediate IR).
High	Quickly escalate to L2/L3 analysts for handling (High escalate to L2/L3).
Medium	Conduct in-depth investigation and verification (Medium investigate).
Low	Perform routine monitoring, triaging, or filtering (Low-monitor / triage).

This triaging ensures that the SOC team remains focused on destructive threats or high-risk dangers, such as ransomware encrypting data , Business Email Compromise (BEC) , or sophisticated impersonation via Deepfake audio/video.  

Download the SOC Investigation playbook

To equip your organization's cybersecurity team with a sharp, practical reference guide that fully supports the monitoring and mitigation of malware, system vulnerabilities, or data exfiltration , you can download the full version of this document. Comprehensive workflows ranging from tracking malicious QR codes (Quishing) and OAuth consent phishing to advanced Active Directory attacks are compiled inside.  

Get your copy of this specialized handbook by accessing the direct source link below:

👉 Download the SOC Investigation Playbook Here (Please refer to the full attached file to look up all playbook scenarios).  

About IPSIP Vietnam

Originating from France with over 15 years of experience, IPSIP specializes in addressing technical vulnerabilities, helping organizations confidently enter the high-tech era without compromising data risks.

IPSIP Vietnam

IPSIP's operational capabilities are absolutely guaranteed globally through its adherence to the most stringent information security management standards such as ISO 27001:2022 and SOC 2 Type II. By operating a continuous 24/7 monitoring system at the Security Operations Center (SOC) and Network Operations Center (NOC), any unusual activity or attempts to extract encrypted data for HNDL campaigns are detected and prevented immediately by IPSIP.

Partner with IPSIP Vietnam - Increase your passive income.

Specifically, the collaboration of a team of over 80 senior experts, holding Privilege Management Authorization (PAM) certifications from the WALLIX Bastion system and AWS architects, will help businesses establish a robust Zero-Trust architecture. This defense system completely isolates sensitive administrator accounts, neutralizing the risk of identity system (IAM) collapse due to manipulation by quantum criminals.

Get your in-depth guide now by accessing the source link below:

Download the SOC Investigation Playbook here.