Vibe Engines is free, interactive AI engineering & system design — runs in your browser. Pick a learning path →
18 stations. 3 tracks. The defensive, blue-team path: from what a SOC does, networking for defenders and the attacker playbook, through logs, SIEM, alert triage, investigation and incident response, to SOAR automation, the AI-assisted SOC and detecting the new AI-era threats.
18 stations on 3 ladders, in order — each rung is written assuming the one above it. Mark them off as you go; your progress is saved in this browser.
6 rungs · ~5h · ends at Detection Engineering.
F1 · Beginner · 35 min
A security operations center is the team that watches an organization’s systems for attacks and responds when they happen — the defensive, blue-team core of security. Learn how a SOC is structured (tier 1 triage, tier 2 investigation, tier 3 hunting and response), what the daily job actually looks like, and the mission: detect fast, respond faster, and reduce the time an attacker has inside. This is where most people enter security.
Build itAn alert fires at 2am for a possible compromise. Walk through who touches it first in a SOC and what "good" triage looks like.
✓ CheckpointDescribe what a Tier 1 analyst escalates and what they close themselves, and why that boundary exists.
F2 · Beginner · 55 min
You can’t defend what you don’t understand. Learn the networking and systems fundamentals a defender needs: TCP/IP, DNS, HTTP, ports and protocols, plus how operating systems, processes, and authentication actually work. This is the mental model you match every alert against — knowing what normal looks like is what lets you spot the abnormal.
Build itAn alert shows a server making DNS requests to a random domain every 60 seconds. Explain why that pattern is suspicious.
✓ CheckpointDescribe what normal DNS traffic looks like on a network you know. You cannot spot abnormal without that baseline.
F3 · Beginner · 50 min
To catch attackers you have to think like one — defensively. Learn the attack lifecycle (the kill chain) and the MITRE ATT&CK framework: the common tactics and techniques adversaries use, from initial access and persistence to lateral movement and exfiltration. Understanding how intrusions actually unfold is what turns a list of alerts into a story you can follow and interrupt.
Build itYou see a phishing click, then a new admin account, then large outbound transfers. Map these to the attack lifecycle.
✓ CheckpointTake a single alert and place it on the kill chain — then say what should have fired before it, and what fires next if you are wrong.
F4 · Beginner · 50 min
Detection runs on data — the logs and telemetry from endpoints, networks, servers, and cloud. Learn the key sources (authentication logs, process creation, network flows, DNS, cloud audit trails), what each reveals, and how to read them. A SOC analyst who knows which log answers which question investigates fast; one who doesn’t drowns.
Build itYou suspect an account was misused. List the specific logs you’d pull and what each would confirm or rule out.
✓ CheckpointName the log source that would prove or disprove a suspected lateral movement, and say whether you actually collect it.
F5 · Intermediate · 55 min
The SIEM (security information and event management platform) is the SOC analyst’s main workspace — it aggregates logs, correlates events, and raises alerts. Learn how a SIEM ingests and normalizes data, how correlation rules turn raw events into alerts, and how to write queries to investigate. Fluency in your SIEM (Splunk, Sentinel, Elastic, and their kind) is the core day-one skill.
Build itWrite, in plain terms, a correlation rule that would alert on many failed logins followed by one success from a new location.
✓ CheckpointExplain why normalization happens before correlation, and what a rule cannot do across un-normalized sources.
F6 · Intermediate · 50 min
Modern SOCs don’t just consume alerts — they engineer their own detections. Learn to write detection rules that catch real attacker behavior (mapped to ATT&CK), to balance true positives against false positives, and to test and version detections like code. Detection engineering is one of the highest-value SOC skills and a major step up from pure alert-watching.
Build itA detection catches the attack but also fires 200 times a day on benign activity. Explain how you’d tune it without missing the real thing.
✓ CheckpointExplain the trade-off in loosening a detection rule, and who pays for it when you tighten it too far.
6 rungs · ~6h · ends at Tuning & Reducing Noise.
T1 · Intermediate · 50 min
Triage is the SOC’s front line: deciding fast whether an alert is a false positive, a benign true positive, or a real incident that needs escalation. Learn a repeatable triage process — gather context, check the indicators, judge severity and scope — and how to make good calls quickly under a flood of alerts. Sharp triage judgment is what a tier-1 analyst lives on, and it’s exactly the judgment AI assists but can’t fully own.
Build itYou get 300 alerts in a shift and can deeply investigate 20. Describe how you’d prioritize which ones actually matter.
✓ CheckpointExplain how you judge severity before you know the full scope, and what you do when the evidence is still ambiguous.
T2 · Advanced · 55 min
Beyond reacting to alerts, strong analysts investigate deeply and hunt proactively for threats that slipped past detections. Learn to pivot through data to reconstruct what happened, to form and test hypotheses about attacker activity, and to hunt for the subtle signs of compromise no alert fired on. Investigation and hunting are where SOC work becomes genuinely skilled and hard to automate.
Build itNo alert fired, but you suspect a quiet intrusion. Describe a threat hunt: what hypothesis, what data, what would confirm it.
✓ CheckpointDescribe a hunt hypothesis specific enough to be wrong, and the data that would settle it.
T3 · Advanced · 55 min
When triage confirms a real incident, response begins: contain, eradicate, recover, and learn. Learn the IR lifecycle, how to contain an active threat without tipping off the attacker or destroying evidence, coordination under pressure, and the post-incident review that turns a bad day into better defenses. Calm, structured response under stress is a defining SOC skill.
Build itYou confirm an attacker has active access right now. Explain the first containment decisions and the trade-offs in each.
✓ CheckpointExplain why containment can tip off an attacker, and how that changes what you do first.
T4 · Intermediate · 45 min
Endpoints — laptops and servers — are where much of the action is, and EDR (endpoint detection and response) tools are how a SOC sees and acts on them. Learn what EDR gives you (process trees, file and registry activity, the ability to isolate a host), how to investigate on the endpoint, and how to respond — isolating a compromised machine while preserving what you need to understand the attack.
Build itEDR shows a Word document spawning PowerShell spawning a network connection. Explain why that chain is a red flag.
✓ CheckpointRead a process tree and say which parent-child relationship is the suspicious one, and why that pairing is unusual.
T5 · Advanced · 45 min
Threat intelligence puts alerts in context — who the adversaries are, what they target, and the indicators and techniques associated with them. Learn to consume and apply intel (indicators of compromise, adversary TTPs), to enrich an investigation with it, and to judge intel critically rather than chasing every indicator. Good use of threat intel turns isolated events into an understanding of who is actually after you.
Build itThreat intel says a group targeting your industry uses a specific technique. Describe how you’d turn that into a proactive check.
✓ CheckpointExplain why an IOC ages badly and a TTP does not, and which you would build a detection on.
T6 · Advanced · 40 min
The quiet killer of SOCs is alert fatigue — thousands of low-value alerts burying the real ones and burning out analysts. Learn to tune detections to cut false positives without creating blind spots, to prioritize by real risk, and to continuously improve signal-to-noise. Reducing noise is both a technical skill and the thing that keeps a SOC (and its people) actually effective.
Build itAnalysts ignore a whole alert category because it’s 99% noise — including the 1% that’s real. Explain how you’d fix that safely.
✓ CheckpointExplain how tuning away a noisy alert creates a blind spot, and what you would do to avoid trading noise for blindness.
6 rungs · ~5h · ends at The SOC Career.
P1 · Advanced · 50 min
Modern SOCs automate the repetitive parts of response with SOAR (security orchestration, automation, and response) — playbooks that enrich alerts, gather context, and take routine actions automatically. Learn to build automation playbooks, to decide what should be automated versus kept human, and to use automation to free analysts for the judgment work. Automation is how a SOC scales without burning out its people.
Build itAnalysts spend hours a day copy-pasting context into every alert. Describe the playbook you’d automate first and why.
✓ CheckpointName a step in your triage you would automate and one you would keep human, and justify the line you drew.
P2 · Advanced · 50 min
AI is reshaping the SOC: summarizing alerts, drafting investigation steps, correlating events, and triaging tier-1 volume. Learn to use AI as a force multiplier — it can accelerate triage and investigation — while owning what it can’t: the judgment on ambiguous cases, the decision to declare an incident, and catching where the AI is confidently wrong. The analyst who supervises and improves the AI stays essential; the one who only did rote triage is exposed.
Build itAn AI triage tool auto-closes an alert as benign, but something feels off. Explain how you’d verify and why that catch is your value.
✓ CheckpointExplain what you check before accepting an AI-written incident summary, and why plausible reads the same as correct.
P3 · Advanced · 50 min
The threats themselves are changing: AI-generated phishing that’s flawless, deepfake-driven social engineering, faster and more adaptive attacks, and entirely new targets like the company’s own AI systems (prompt injection, model abuse). Learn what these AI-era threats look like and how detection must adapt — including monitoring the organization’s AI applications as a new part of the attack surface. Defending in the AI era means defending against and around AI.
Build itYour company deploys a customer-facing AI agent. Describe what new attacks a SOC now has to watch for and how.
✓ CheckpointExplain what changes about phishing detection when the text has no errors left to spot.
P4 · Advanced · 40 min
Purple teaming is where defense (blue) and offense (red) collaborate: attackers simulate real techniques so defenders can validate and improve detections against them. Learn to run and learn from purple-team exercises, to turn "the red team got in undetected here" into concrete new detections, and to continuously test your coverage against real adversary behavior. This closes the loop between how attacks work and how you catch them.
Build itA purple-team exercise shows the red team moved laterally with zero alerts. Describe how you’d turn that gap into detection.
✓ CheckpointDescribe a detection gap purple teaming would find that no amount of rule-writing would have surfaced.
P5 · Advanced · 35 min
A SOC is judged on outcomes and only lasts if its people do. Learn the metrics that actually matter (time to detect, time to respond, and honest coverage — not vanity alert counts), how to measure and improve them, and how to fight the burnout that plagues the field through automation, tuning, and sane processes. A sustainable SOC that measures the right things beats a heroic one that grinds its analysts down.
Build itLeadership tracks "alerts closed per analyst." Explain why that metric can make the SOC worse and what you’d measure instead.
✓ CheckpointExplain why MTTR can improve while the SOC gets worse, and what alert fatigue does to the numbers.
P6 · Advanced · 40 min
The SOC is a launchpad into much of security. Learn where the path goes — from tier-1 analyst up through detection engineer, incident responder, threat hunter, and SOC lead, and outward into red teaming, threat intel, security engineering, or the AI-security specialties. Understand how AI is reshaping entry-level SOC work (rote triage automates; judgment and engineering grow in value), and how to build the skills and portfolio that move you up and out.
Build itWrite the six-month plan that moves you from tier-1 alert triage to detection engineering or incident response.
✓ CheckpointExplain which parts of Tier 1 work AI is genuinely absorbing, and what that means for where you build depth.
The common questions before you start — how long it takes, whether to follow it in order, and how it stays current.
It runs 18 stations across 3 tracks — roughly ~16h of focused learning, plus the time you spend actually building. It is self-paced, so most people work through it over a few weeks, an evening or a single station at a time.
The tracks are ordered so each station builds on the one before, and following them start to finish is the intended path. But every station also stands alone — if you already have the foundations, jump straight to the part you need.
Yes. The whole roadmap, and every handbook, lab, and challenge it links to, is free and open — no sign-up and no paywall.
It teaches the durable fundamentals of the role first, then the tooling and the AI-era shifts on top — so most of it stays relevant as individual tools churn, and it is revised as the role itself changes.
Anyone stepping into or leveling up in the SOC Analyst role — whether you are switching in, early-career, or a senior filling gaps. Start where you are; the ladder shows what is left.
See this alongside everything else on the same subject — handbooks, system designs, challenges and tools, in one place.