Chapter 18 — Review and next steps
Lesson map
Lesson 18 published. Map, example, EX069.
flowchart TD
N0["Learning outcomes"]
N1["18.1 Looking back"]
N2["18.2 Skills"]
N3["18.3 Development"]
N4["18.4 Mentoring"]
N5["18.5 Ethics"]
N6["18.6 Next course"]
N7["What the case taught"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX069"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["18.1 Looking back"]
N2["18.2 Skills"]
N3["18.3 Development"]
N4["18.4 Mentoring"]
N5["18.5 Ethics"]
N6["18.6 Next course"]
N7["What the case taught"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX069"]
[Learning outcomes]
|
v
[18.1 Looking back]
|
v
[18.2 Skills]
|
v
[18.3 Development]
|
v
[18.4 Mentoring]
|
v
[18.5 Ethics]
|
v
[18.6 Next course]
|
v
[What the case taught]
|
v
[Worked example] --> [Exercise EX069]
Learning outcomes
You will (1) review the whole SOC journey; (2) connect each skill to the case; (3) plan personal development; (4) prepare for further study.
18.1 Looking back
From Monday's 46 failures to a tuned, tested rule and MFA on the portal, Carlos has seen the full loop. The loop runs from 46 failures to a rule tested on the Monday log, MFA on the portal and named accounts for the gardeners. Each step taught a different skill, and each depended on the one before. Carlos can now explain to a new trainee why every step was needed. The same chain of steps would apply to any new case he handles at the council.
18.2 Skills
Logs, triage, endpoint and network analysis, intelligence, response, detection, tuning, metrics, wellbeing and maturity. Each skill appears in a case: logs and triage in parks01, network analysis in the finance phishing, tuning in the admin-tool rule, metrics in the shift-change outlier. Wellbeing and maturity apply across all of these cases rather than belonging to any single one. The list maps to the eighteen chapters of the course. Carlos's six-month review lists the cases and records that show evidence for each skill.
18.3 Development
Carlos plans a certificate course and a lab project on file-share monitoring. The file-share monitoring project follows from the coverage gap and from parks01's six minutes of folder listing, which no rule would have flagged if files had been taken. A certificate course adds structured study to the learning time he already uses. Aisha reviews both plans with him at their next monthly meeting. Both plans include target dates and a concrete way to show results to Aisha and the team.
18.4 Mentoring
Aisha meets him monthly to review cases. Monthly reviews let Aisha check Carlos's notes and decisions on real cases and suggest improvements. They also give Carlos a regular place to raise problems early, such as fatigue. Mentoring continues the support he had in his first weeks, now focused on judgement rather than basics. The meetings are booked in advance so busy weeks do not push them out. Each meeting reviews at least one of Carlos's recent cases in detail, including his notes.
18.5 Ethics
SOC access to staff activity is powerful; it must be used only for security purposes, under policy. In the finance case, Carlos read only the logs needed to see who clicked, not staff's browsing in general. The SIEM gives access to much more than any case needs, so policy and purpose set the limit. Misusing it would damage trust between the SOC and staff. Any search beyond what a case needs requires a reason recorded in that case's notes for Aisha to see.
18.6 Next course
The next stop covers incident response and cyber resilience in depth. The parks01 and finance cases were minor, but larger incidents need deeper response skills, such as handling significant or major incidents with service disruption. The next course builds on the incident process and containment chapters here. It also covers recovery and resilience in more detail than a SOC course can. Carlos's notes from the cases here will be useful material there. The six-month review lists those cases, including INC-0417 and the finance phishing incident.
What the case taught
The parks01 case shows that a small event touches every part of the SOC. A weak shared password let in an outsider; logs showed the attempt; a rule raised an alert; triage linked the alerts; endpoint and share logs confirmed what happened; a proportionate action stopped it; plain communication kept the parks team working; lessons led to MFA and named accounts; a new detection and better metrics followed. Each chapter of this book covered one link in that chain, and a weakness in any link would have let the outsider stay longer.
Continuing practice
Skills fade without use. Carlos keeps a personal lab with synthetic logs where he rebuilds detections and practises searches, and he joins the local-government sharing group's monthly call to hear what other councils are seeing. He also volunteers to update one runbook a month, which keeps his knowledge of procedures fresh and improves the documents for everyone on the team.
Worked example
Carlos's six-month review lists 120 alerts triaged, three incidents led, two rules written and one metric changed.
Synthetic case. Review contents are invented.
Errors and limits
A technical course covers foundations; deeper study needs practice.
Exercises
- EX069 — Full loop. Summarise the INC-0417 loop. Rubric: 3 = alert, triage, contain, lessons, rule, MFA; 2 = partial; 1 = one; 0 = none.
- EX070 — Ethics. Why must SOC access be limited? Rubric: 3 = powerful; security purposes under policy; 2 = partial; 1 = vague; 0 = none.
- EX071 — Review numbers. What did the six-month review list? Rubric: 3 = 120 alerts, 3 incidents, 2 rules, 1 metric; 2 = partial; 1 = vague; 0 = none.
- EX072 — Plan. Name one development step. Rubric: 3 = certificate course or file-share monitoring project; 2 = partial; 1 = vague; 0 = none.
Synthesis
The SOC is a loop of seeing, deciding, acting and learning.
Continue studying — chapter 18 of 18
← Chapter 17 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →