// Phase 3 · Core SOC Analyst Skills · Daily Plan · 2026

56 Days to
Real SOC Analyst

Splunk SPL queries, MITRE ATT&CK deep dive, Wireshark PCAP malware analysis, threat intelligence, IDS/IPS with Suricata, LetsDefend advanced labs — 3 major portfolio projects.

8 weeks
56 days
Days 113–168
Months 4–7
3 portfolio projects
🔥 Phase 3 is where you become a SOC analyst. You will investigate real attack scenarios in Splunk, analyse actual malware traffic in Wireshark, write Suricata IDS rules, and complete advanced LetsDefend incidents. By Day 168 your portfolio will be indistinguishable from someone with 6 months of real experience. Hindi resources and notes included throughout.
Phase
3 of 5
Timeline
Months 4–7
Days
113–168
Portfolio adds
+3 projects
🎯 Skills: Splunk · MITRE ATT&CK · PCAP · Suricata · Threat Intel
Days done
0
Tasks done
0
Total tasks
0
Phase 3 progress — 0%
0
day streak
Phase 3 study tips
Mastering Phase 3
🔎
Splunk: think like an investigator, not a developer
SPL is not programming — it's querying evidence. Every search should answer a specific question: "Who logged in after hours?" "Which IPs made DNS requests to unusual domains?" Always start with a question.
🗺️
MITRE ATT&CK — use the Navigator daily
Open ATT&CK Navigator and highlight techniques as you learn them. After 3 weeks you'll have a visual map of what you know. This screenshot in your portfolio shows maturity that most juniors lack.
🐠
Wireshark: slow down on every PCAP
The temptation is to jump to the suspicious packets. Instead: check Statistics → Protocol Hierarchy first. Then Conversations. Then follow the biggest TCP stream. Let the data tell the story.
📝
Every PCAP analysis needs a write-up
Even a 5-minute analysis deserves a paragraph: what you found, which Wireshark filters you used, what the IOCs were, and what the attacker did. These write-ups are your portfolio entries — don't skip them.
🇮🇳
Hindi learners — read Splunk docs in English
Watch Hindi explanation videos first to understand the concept. But for Splunk SPL and MITRE ATT&CK, spend time reading the official English docs too — the actual job will use this English terminology.
🔄
Connect every technique back to ATT&CK
Every attack you see in a PCAP, every Splunk alert, every Wazuh rule — map it to a MITRE ATT&CK technique number. T1059 = command execution. T1566 = phishing. This becomes second nature within 2 weeks.
🏆
LetsDefend write-ups = interview gold
Every completed LetsDefend incident should be exported or screenshotted and added to GitHub. When an interviewer asks "show me how you investigate an alert" — open your GitHub. Most candidates can't do this.
Speed matters in Tier 1 SOC — time yourself
From Week 21 onwards, start timing how long each PCAP analysis and LetsDefend incident takes you. Real SOC targets are 15–30 min for Tier 1 investigation. Getting faster builds real-world readiness.