Days done
0
Tasks done
0
Total tasks
0
0
day streak
Phase 3 study tips
Mastering Phase 3
Splunk: think like an investigator, not a developer
SPL is not programming — it's querying evidence. Every search should answer a specific question: "Who logged in after hours?" "Which IPs made DNS requests to unusual domains?" Always start with a question.
MITRE ATT&CK — use the Navigator daily
Open ATT&CK Navigator and highlight techniques as you learn them. After 3 weeks you'll have a visual map of what you know. This screenshot in your portfolio shows maturity that most juniors lack.
Wireshark: slow down on every PCAP
The temptation is to jump to the suspicious packets. Instead: check Statistics → Protocol Hierarchy first. Then Conversations. Then follow the biggest TCP stream. Let the data tell the story.
Every PCAP analysis needs a write-up
Even a 5-minute analysis deserves a paragraph: what you found, which Wireshark filters you used, what the IOCs were, and what the attacker did. These write-ups are your portfolio entries — don't skip them.
Hindi learners — read Splunk docs in English
Watch Hindi explanation videos first to understand the concept. But for Splunk SPL and MITRE ATT&CK, spend time reading the official English docs too — the actual job will use this English terminology.
Connect every technique back to ATT&CK
Every attack you see in a PCAP, every Splunk alert, every Wazuh rule — map it to a MITRE ATT&CK technique number. T1059 = command execution. T1566 = phishing. This becomes second nature within 2 weeks.
LetsDefend write-ups = interview gold
Every completed LetsDefend incident should be exported or screenshotted and added to GitHub. When an interviewer asks "show me how you investigate an alert" — open your GitHub. Most candidates can't do this.
Speed matters in Tier 1 SOC — time yourself
From Week 21 onwards, start timing how long each PCAP analysis and LetsDefend incident takes you. Real SOC targets are 15–30 min for Tier 1 investigation. Getting faster builds real-world readiness.