Agent Foskett Academy • SOC Analyst Learning Path • 100 Lessons

Agent Foskett SOC Analyst Academy

This is the dedicated home for the Agent Foskett Security Operations Analyst learning path.

Across 100 scenario-driven lessons, analysts learn how to triage alerts, investigate incidents, follow evidence across Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra and cloud services, make defensible decisions, escalate correctly, contain threats and document what happened.

The specialist academies teach the technology. This academy teaches the job.

100Planned SOC analyst lessons

10Structured investigation modules

XDRIdentity, endpoint, email and cloud incidents

SOCTriage, investigation, response and escalation

Browse SOC Learning Paths Back to Academy Portal

SOC Academy focus

Learn how an analyst thinks when the queue is full, the evidence is incomplete and a decision still has to be made.

Alert triage and prioritisation

Evidence-driven investigations

Containment, escalation and handover

SOC Analyst Academy learning paths

Ten modules move from alert triage through identity, endpoint, email, cloud, incident response, threat hunting and detection engineering, finishing with complete SOC investigation scenarios.

Module 1 — Inside the SOC: Thinking Like an Analyst Lessons 1–10 • Scenario-driven SOC investigation and decision-making.

Module 1 • Lesson 1

The Alert Queue Has 47 Alerts Prioritise a busy alert queue using severity, confidence, asset value, identity risk and evidence.

Module 1 • Lesson 2

The Alert Says Suspicious Investigate what made the alert suspicious and validate the evidence before deciding whether the activity represents a genuine threat.

Module 1 • Lesson 3

Three Alerts Were Actually One Incident Recognise when separate alerts belong to one attack story and should be investigated together.

Module 1 • Lesson 4

The User Said “I Didn't Do That” Use user statements as evidence without allowing them to replace technical validation.

Module 1 • Lesson 5

What Evidence Do You Collect First? Build an evidence-first workflow before deciding what the incident means.

Module 1 • Lesson 6

The Alert Had Five Entities — Which One Do You Pivot On? Choose the most useful user, device, IP, process, file or URL pivot for the next step.

Module 1 • Lesson 7

When Do You Stop Investigating? Decide when evidence is sufficient to close, contain, escalate or continue.

Module 1 • Lesson 8

This One Needs Escalation Recognise scope, impact and uncertainty that require escalation.

Module 1 • Lesson 9

Another Analyst Has to Read Your Notes Tomorrow Write investigation notes that preserve facts, reasoning and outstanding questions.

Module 1 • Lesson 10

From Alert to Closure — Your First SOC Investigation Bring prioritisation, evidence, pivots, decisions and documentation together.

Module 2 — Alert Triage: Deciding What Matters First Lessons 11–20 • Scenario-driven SOC investigation and decision-making.

Module 2 • Lesson 11

The Same Alert Fired on 30 Devices Distinguish one widespread incident from repeated low-value alerts.

Module 2 • Lesson 12

The Alert Was Medium — The Account Was Global Admin Add entity criticality and business context to technical severity.

Module 2 • Lesson 13

The IP Address Looked Malicious — Until We Checked the Context Validate indicators before treating reputation as proof.

Module 2 • Lesson 14

The Alert Had Already Been Seen Yesterday Use recurrence and history during triage.

Module 2 • Lesson 15

The Device Was a Server, Not a Workstation Adjust triage when asset function changes potential impact.

Module 2 • Lesson 16

The Alert Arrived During a Known Change Window Use change context without automatically dismissing suspicious behaviour.

Module 2 • Lesson 17

Five Low-Severity Alerts Formed One High-Risk Story Correlate weak signals during triage.

Module 2 • Lesson 18

The Incident Queue Was Growing Faster Than We Could Clear It Prioritise under pressure without simply sorting by severity.

Module 2 • Lesson 19

The Alert Needed More Context Before a Verdict Identify the minimum additional evidence needed for a defensible decision.

Module 2 • Lesson 20

Building a Repeatable SOC Triage Workflow Turn individual triage skills into a consistent operational process.

Module 3 — Identity Incidents Lessons 21–30 • Scenario-driven SOC investigation and decision-making.

Module 3 • Lesson 21

The Successful Sign-In Wasn't Normal Investigate successful authentication when the surrounding context is suspicious.

Module 3 • Lesson 22

The User Received Twelve MFA Prompts Investigate MFA fatigue and repeated authentication attempts.

Module 3 • Lesson 23

A New MFA Method Appeared After the Sign-In Correlate authentication-method changes with identity activity.

Module 3 • Lesson 24

Conditional Access Said Success — What Actually Happened? Interpret Conditional Access in the wider sign-in story.

Module 3 • Lesson 25

The Privileged Role Became Active Overnight Investigate unexpected privilege elevation.

Module 3 • Lesson 26

The Same IP Address Touched Five Accounts Correlate one source across multiple identities and investigate spraying, credential testing or shared infrastructure.

Module 3 • Lesson 27

The Sign-In Was Successful but the Session Wasn't Normal Follow suspicious identity activity beyond successful authentication and investigate abnormal session behaviour.

Module 3 • Lesson 28

The OAuth Application Had More Access Than Expected Investigate consent, permissions and application access.

Module 3 • Lesson 29

The Service Principal Started Acting Like an Administrator Investigate unexpected application identity privilege, credential changes and administrative activity.

Module 3 • Lesson 30

From Suspicious Sign-In to Identity Compromise Bring the complete identity investigation together across authentication, MFA, privilege, sessions, OAuth and application activity.

Module 4 — Endpoint Incidents: Following the Attack Chain Lessons 31–40 • Scenario-driven SOC investigation and decision-making.

Module 4 • Lesson 31

The Browser Spawned PowerShell Follow an unusual browser-to-PowerShell process chain.

Module 4 • Lesson 32

The PowerShell Command Was Encoded Investigate obfuscated or encoded command execution.

Module 4 • Lesson 33

The Process Tree Didn't Match Normal User Activity Use process ancestry to distinguish normal from suspicious execution.

Module 4 • Lesson 34

The File Appeared Seconds Before It Executed Correlate file creation with execution.

Module 4 • Lesson 35

The Process Connected to an External IP Connect execution with outbound network activity.

Module 4 • Lesson 36

The Suspicious Process Created Persistence Investigate scheduled tasks, registry changes and persistence.

Module 4 • Lesson 37

LSASS Was Accessed by an Unexpected Process Recognise credential-access behaviour.

Module 4 • Lesson 38

The Account Logged On to Another Device Minutes Later Follow possible lateral movement.

Module 4 • Lesson 39

The Device Needed Containment — What Happens Next? Move from investigation to isolation, evidence collection and remediation.

Module 4 • Lesson 40

Building the Complete Endpoint Compromise Timeline Reconstruct the attack chain from execution to movement.

Module 5 — Email & Phishing: From Message to Compromise Lessons 41–50 • Scenario-driven SOC investigation and decision-making.

Module 5 • Lesson 41

The Email Looked Legitimate at First Start phishing triage with sender, authentication and delivery evidence.

Module 5 • Lesson 42

The Display Name Was Familiar — The Domain Wasn't Separate visual trust from sender identity.

Module 5 • Lesson 43

The Link Was Clicked Follow a message into URL-click and endpoint evidence.

Module 5 • Lesson 44

The Attachment Reached the Inbox Trace attachment delivery and execution.

Module 5 • Lesson 45

The Message Passed Authentication — But Was Still Suspicious Understand why authentication results do not settle the case.

Module 5 • Lesson 46

The User Entered Their Credentials Move from phishing analysis into identity response.

Module 5 • Lesson 47 • Published

A New Inbox Rule Appeared Investigate post-compromise mailbox manipulation.

Module 5 • Lesson 48 • Published

The Mailbox Started Forwarding Externally Identify forwarding-based persistence and exposure.

Module 5 • Lesson 49 • Published

Was Anyone Else Targeted? Scope a phishing campaign across users and infrastructure.

Module 5 • Lesson 50 • Published

From Phish to Compromise — Build the Full Timeline Combine email, click, identity and endpoint evidence.

Module 6 — Cloud & SaaS Incidents Lessons 51–60 • Scenario-driven SOC investigation and decision-making.

Module 6 • Lesson 51 • Published

The User Downloaded Gigabytes Before Leaving Investigate unusual cloud data access with business context.

Module 6 • Lesson 52 • Published

The Same Account Accessed SharePoint from Two Countries Evaluate location anomalies carefully.

Module 6 • Lesson 53 • Published

Hundreds of Files Were Downloaded in Minutes Measure bulk data access and compare it with normal behaviour.

Module 6 • Lesson 54 • Published

The OAuth Application Was Granted Consent Investigate cloud persistence through consent.

Module 6 • Lesson 55 • Published

The Application Accessed Data Without the User Follow non-interactive application access.

Module 6 • Lesson 56 • Published

The Account Shared a Sensitive File Externally Investigate external sharing and exposure.

Module 6 • Lesson 57 • Published

The Cloud Alert Had No Endpoint Evidence Work an incident where evidence exists only in cloud services.

Module 6 • Lesson 58 • Published

The Activity Crossed Entra, Exchange and SharePoint Follow one identity across Microsoft cloud workloads.

Module 6 • Lesson 59 • Published

Was This Insider Activity or Account Compromise? Compare competing hypotheses using evidence.

Module 6 • Lesson 60 • Published

Building the Complete Cloud Compromise Timeline Create a defensible cross-service timeline.

Module 7 — Incident Response: Containment, Evidence & Escalation Lessons 61–70 • Scenario-driven SOC investigation and decision-making.

Module 7 • Lesson 61 • Published

The Investigation Became an Incident Recognise the transition from analysis to coordinated response.

Module 7 • Lesson 62 • Published

Do We Isolate the Device Now? Balance containment urgency against business impact and uncertainty.

Module 7 • Lesson 63 • Published

Do We Disable the Account? Assess identity containment options and consequences.

Module 7 • Lesson 64 • Published

What Evidence Must We Preserve? Identify telemetry and artefacts that matter before remediation.

Module 7 • Lesson 65 • Published

The Attack Was Still Active Prioritise containment when malicious activity continues.

Module 7 • Lesson 66 • Published

The Incident Crossed Multiple Teams Coordinate identity, endpoint, messaging, cloud and business stakeholders.

Module 7 • Lesson 67 • Published

The Scope Kept Growing Reassess affected entities as evidence expands.

Module 7 • Lesson 68 • Published

When Do We Call It Contained? Define evidence-based containment.

Module 7 • Lesson 69 • Published

Writing the Incident Handover Transfer status, evidence, actions and unanswered questions.

Module 7 • Lesson 70 • Published

From Detection to Recovery — Run the Incident Work the full response lifecycle.

Module 8 — Threat Hunting: Looking Beyond the Alerts Lessons 71–80 • Scenario-driven SOC investigation and decision-making.

Module 8 • Lesson 71 • Published

The Hunt Started with a Behaviour, Not an IOC Form a behavioural hypothesis instead of waiting for an indicator.

Module 8 • Lesson 72 • Published

One Query Found the Same Technique on Twelve Devices Scope one behaviour across the environment.

Module 8 • Lesson 73 • Published

The Alert Was Quiet — The Hunt Wasn't Use proactive hunting to find related activity.

Module 8 • Lesson 74 • Published

What Does Normal Look Like Here? Build a baseline before declaring an anomaly.

Module 8 • Lesson 75 • Published

The Baseline Changed Separate legitimate drift from attack behaviour.

Module 8 • Lesson 76 • Published

Three Weak Signals Became One Strong Lead Combine weak behaviours into a stronger hunting candidate.

Module 8 • Lesson 77 • Published

The Hunt Found Nothing — Was It Still Useful? Treat negative findings as evidence without overstating them.

Module 8 • Lesson 78 • Published

The IOC Changed — The Behaviour Didn't Build hunts that survive infrastructure changes.

Module 8 • Lesson 79 • Published

The Hunt Needs Another Data Source Recognise telemetry limits.

Module 8 • Lesson 80 • Published

Turn the Successful Hunt into Team Capability Package a hunt so another analyst can repeat it.

Module 9 — Detection Engineering: Turning Findings into Protection Lessons 81–90 • Scenario-driven SOC investigation and decision-making.

Module 9 • Lesson 81 • Published

This Investigation Should Become a Detection Recognise repeatable malicious behaviour worth operationalising.

Module 9 • Lesson 82 • Published

The Detection Generated Too Many False Positives Tune noise without deleting the security hypothesis.

Module 9 • Lesson 83 • Published

Build a Baseline Before Setting the Threshold Use historical behaviour to justify thresholds.

Module 9 • Lesson 84 • Published

The Detection Looked Good Until We Backtested It Test logic against historical telemetry.

Module 9 • Lesson 85 • Published

The Detection Fired 600 Times a Day Measure analyst workload and group repeated events.

Module 9 • Lesson 86

The Threshold Hid a Real Attack Understand the false-negative cost of tuning.

Module 9 • Lesson 87

The Detection Duplicated Another Rule Reduce redundant analyst work while preserving coverage.

Module 9 • Lesson 88

The Environment Changed After Deployment Monitor drift and revisit assumptions.

Module 9 • Lesson 89

Can Another Analyst Explain Why This Alert Fired? Build transparent, explainable detections.

Module 9 • Lesson 90

From Hunt to Production Detection Complete the detection-engineering lifecycle.

Module 10 — Complete SOC Investigation Scenarios Lessons 91–100 • Scenario-driven SOC investigation and decision-making.

Module 10 • Lesson 91

Monday 09:02 — The Queue Is Already Full Run a realistic shift-opening triage scenario.

Module 10 • Lesson 92

The Phishing Email Became an Identity Incident Follow one case across email and identity.

Module 10 • Lesson 93

The Identity Incident Reached the Endpoint Correlate compromise with process and device activity.

Module 10 • Lesson 94

The Endpoint Incident Became Lateral Movement Scope movement to additional devices.

Module 10 • Lesson 95

The Cloud Data Started Leaving Investigate cross-service exfiltration.

Module 10 • Lesson 96

The Executive Account Was Compromised Handle high-impact identity risk and escalation.

Module 10 • Lesson 97

The Ransomware Alert Was Only the Middle of the Story Reconstruct activity before and after the loudest alert.

Module 10 • Lesson 98

The Insider-Threat Hypothesis Was Wrong Change direction when evidence disagrees with the theory.

Module 10 • Lesson 99

The Night Shift Needs a Complete Handover Produce a defensible handover for an unfinished incident.

Module 10 • Lesson 100

Your Final SOC Investigation Triage, investigate, scope, contain, document and close a multi-stage incident.

What makes this SOC Analyst Academy different?

This academy connects the existing Agent Foskett technical learning paths and puts the learner in the analyst's chair.

Scenario-first learningLessons begin with an alert, incident or investigative problem and teach the analyst how to reason through it.

Cross-product investigationsMove between Defender XDR, Sentinel, Entra, endpoint, email, cloud and KQL as the evidence requires.

Built for real analyst decisionsLearn when to pivot, when to stop, when to contain, when to escalate and how to explain the evidence.

Supporting Agent Foskett academies

Use the specialist academies whenever a SOC investigation requires deeper technical knowledge.

KQL AcademyLearn practical KQL for Defender XDR, Sentinel, advanced hunting and investigation timelines.

Microsoft Sentinel AcademyLearn incidents, analytics rules, hunting, entity mapping, automation, workbooks and response workflows.

Microsoft Entra Security AcademyExplore sign-ins, identity protection, MFA, Conditional Access, PIM and identity governance.

Defender for Endpoint AcademyInvestigate devices, timelines, processes, network activity, Live Response, isolation and remediation.

Defender for Cloud AcademyExplore cloud posture, workload protection, attack paths, security alerts and cloud incident response.

Security Copilot AcademyUse AI-assisted triage, incident summaries, threat hunting and investigation workflows with analyst validation.

Defender XDR Investigation WorkflowReview the existing end-to-end Microsoft Defender XDR investigation workflow.

Building an Incident TimelineLearn how to turn separate security events into one chronological investigation story.

Main Academy PortalReturn to the complete Agent Foskett Academy hub covering all Microsoft security learning paths.

Final thought

Security tools generate evidence. Analysts turn that evidence into decisions.

The logs already knew.The SOC Analyst Academy teaches you how to decide which logs matter, what the evidence supports and what should happen next.

Agent Foskett SOC Analyst Academy

Agent Foskett SOC Analyst Academy is a 100-lesson Microsoft Security Operations learning path covering SOC alert triage, incident investigation, identity security, endpoint incidents, phishing, cloud and SaaS investigations, incident response, threat hunting and detection engineering.

Learn Microsoft Security Operations

Learn practical SOC analyst workflows using Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra, KQL, Defender for Endpoint, Defender for Cloud and Microsoft Security Copilot.

Scenario-driven SOC analyst training

The learning path uses realistic security incidents to teach prioritisation, evidence collection, investigation pivots, containment, escalation, handover and defensible conclusions.