Agent Foskett Academy • SOC Analyst Learning Path • 100 Lessons

Agent Foskett SOC Analyst Academy

This is the dedicated home for the Agent Foskett Security Operations Analyst learning path.

Across 100 scenario-driven lessons, analysts learn how to triage alerts, investigate incidents, follow evidence across Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra and cloud services, make defensible decisions, escalate correctly, contain threats and document what happened.

The specialist academies teach the technology. This academy teaches the job.

100Planned SOC analyst lessons

10Structured investigation modules

XDRIdentity, endpoint, email and cloud incidents

SOCTriage, investigation, response and escalation

Browse SOC Learning Paths Back to Academy Portal

SOC Academy focus

Learn how an analyst thinks when the queue is full, the evidence is incomplete and a decision still has to be made.

Alert triage and prioritisation

Evidence-driven investigations

Containment, escalation and handover

SOC Analyst Academy learning paths

Ten modules move from alert triage through identity, endpoint, email, cloud, incident response, threat hunting and detection engineering, finishing with complete SOC investigation scenarios.

Module 1 — Inside the SOC: Thinking Like an Analyst Lessons 1–10 • Scenario-driven SOC investigation and decision-making.

Module 1 • Lesson 1 • Published

The Alert Queue Has 47 Alerts Prioritise a busy alert queue using severity, confidence, asset value, identity risk and evidence.

Module 1 • Lesson 2 • Published

The Alert Says Suspicious Investigate what made the alert suspicious and validate the evidence before deciding whether the activity represents a genuine threat.

Module 1 • Lesson 3 • Published

Three Alerts Were Actually One Incident Recognise when separate alerts belong to one attack story and should be investigated together.

Module 1 • Lesson 4 • Published

The User Said “I Didn't Do That” Use user statements as evidence without allowing them to replace technical validation.

Module 1 • Lesson 5 • Published

What Evidence Do You Collect First? Build an evidence-first workflow before deciding what the incident means.

Module 1 • Lesson 6 • Published

The Alert Had Five Entities — Which One Do You Pivot On? Choose the most useful user, device, IP, process, file or URL pivot for the next step.

Module 1 • Lesson 7 • Published

When Do You Stop Investigating? Decide when evidence is sufficient to close, contain, escalate or continue.

Module 1 • Lesson 8 • Published

This One Needs Escalation Recognise scope, impact and uncertainty that require escalation.

Module 1 • Lesson 9 • Published

Another Analyst Has to Read Your Notes Tomorrow Write investigation notes that preserve facts, reasoning and outstanding questions.

Module 1 • Lesson 10 • Published

From Alert to Closure — Your First SOC Investigation Bring prioritisation, evidence, pivots, decisions and documentation together.

Module 2 — Alert Triage: Deciding What Matters First Lessons 11–20 • Scenario-driven SOC investigation and decision-making.

Module 2 • Lesson 11 • Published

The Same Alert Fired on 30 Devices Distinguish one widespread incident from repeated low-value alerts.

Module 2 • Lesson 12 • Published

The Alert Was Medium — The Account Was Global Admin Add entity criticality and business context to technical severity.

Module 2 • Lesson 13 • Published

The IP Address Looked Malicious — Until We Checked the Context Validate indicators before treating reputation as proof.

Module 2 • Lesson 14 • Published

The Alert Had Already Been Seen Yesterday Use recurrence and history during triage.

Module 2 • Lesson 15 • Published

The Device Was a Server, Not a Workstation Adjust triage when asset function changes potential impact.

Module 2 • Lesson 16 • Published

The Alert Arrived During a Known Change Window Use change context without automatically dismissing suspicious behaviour.

Module 2 • Lesson 17 • Published

Five Low-Severity Alerts Formed One High-Risk Story Correlate weak signals during triage.

Module 2 • Lesson 18 • Published

The Incident Queue Was Growing Faster Than We Could Clear It Prioritise under pressure without simply sorting by severity.

Module 2 • Lesson 19 • Published

The Alert Needed More Context Before a Verdict Identify the minimum additional evidence needed for a defensible decision.

Module 2 • Lesson 20 • Published

Building a Repeatable SOC Triage Workflow Turn individual triage skills into a consistent operational process.

Module 3 — Identity Incidents Lessons 21–30 • Scenario-driven SOC investigation and decision-making.

Module 3 • Lesson 21 • Published

The Successful Sign-In Wasn't Normal Investigate successful authentication when the surrounding context is suspicious.

Module 3 • Lesson 22 • Published

The User Received Twelve MFA Prompts Investigate MFA fatigue and repeated authentication attempts.

Module 3 • Lesson 23 • Published

A New MFA Method Appeared After the Sign-In Correlate authentication-method changes with identity activity.

Module 3 • Lesson 24 • Published

Conditional Access Said Success — What Actually Happened? Interpret Conditional Access in the wider sign-in story.

Module 3 • Lesson 25 • Published

The Privileged Role Became Active Overnight Investigate unexpected privilege elevation.

Module 3 • Lesson 26 • Published

The Same IP Address Touched Five Accounts Correlate one source across multiple identities and investigate spraying, credential testing or shared infrastructure.

Module 3 • Lesson 27 • Published

The Sign-In Was Successful but the Session Wasn't Normal Follow suspicious identity activity beyond successful authentication and investigate abnormal session behaviour.

Module 3 • Lesson 28 • Published

The OAuth Application Had More Access Than Expected Investigate consent, permissions and application access.

Module 3 • Lesson 29 • Published

The Service Principal Started Acting Like an Administrator Investigate unexpected application identity privilege, credential changes and administrative activity.

Module 3 • Lesson 30 • Published

From Suspicious Sign-In to Identity Compromise Bring the complete identity investigation together across authentication, MFA, privilege, sessions, OAuth and application activity.

Module 4 — Endpoint Incidents: Following the Attack Chain Lessons 31–40 • Scenario-driven SOC investigation and decision-making.

Module 4 • Lesson 31 • Planned

The Browser Spawned PowerShell Follow an unusual browser-to-PowerShell process chain.

Module 4 • Lesson 32 • Planned

The PowerShell Command Was Encoded Investigate obfuscated or encoded command execution.

Module 4 • Lesson 33 • Planned

The Process Tree Didn't Match Normal User Activity Use process ancestry to distinguish normal from suspicious execution.

Module 4 • Lesson 34 • Planned

The File Appeared Seconds Before It Executed Correlate file creation with execution.

Module 4 • Lesson 35 • Planned

The Process Connected to an External IP Connect execution with outbound network activity.

Module 4 • Lesson 36 • Planned

The Suspicious Process Created Persistence Investigate scheduled tasks, registry changes and persistence.

Module 4 • Lesson 37 • Planned

LSASS Was Accessed by an Unexpected Process Recognise credential-access behaviour.

Module 4 • Lesson 38 • Planned

The Account Logged On to Another Device Minutes Later Follow possible lateral movement.

Module 4 • Lesson 39 • Planned

The Device Needed Containment — What Happens Next? Move from investigation to isolation, evidence collection and remediation.

Module 4 • Lesson 40 • Planned

Building the Complete Endpoint Compromise Timeline Reconstruct the attack chain from execution to movement.

Module 5 — Email & Phishing: From Message to Compromise Lessons 41–50 • Scenario-driven SOC investigation and decision-making.

Module 5 • Lesson 41 • Planned

The Email Looked Legitimate at First Start phishing triage with sender, authentication and delivery evidence.

Module 5 • Lesson 42 • Planned

The Display Name Was Familiar — The Domain Wasn't Separate visual trust from sender identity.

Module 5 • Lesson 43 • Planned

The Link Was Clicked Follow a message into URL-click and endpoint evidence.

Module 5 • Lesson 44 • Planned

The Attachment Reached the Inbox Trace attachment delivery and execution.

Module 5 • Lesson 45 • Planned

The Message Passed Authentication — But Was Still Suspicious Understand why authentication results do not settle the case.

Module 5 • Lesson 46 • Planned

The User Entered Their Credentials Move from phishing analysis into identity response.

Module 5 • Lesson 47 • Planned

A New Inbox Rule Appeared Investigate post-compromise mailbox manipulation.

Module 5 • Lesson 48 • Planned

The Mailbox Started Forwarding Externally Identify forwarding-based persistence and exposure.

Module 5 • Lesson 49 • Planned

Was Anyone Else Targeted? Scope a phishing campaign across users and infrastructure.

Module 5 • Lesson 50 • Planned

From Phish to Compromise — Build the Full Timeline Combine email, click, identity and endpoint evidence.

Module 6 — Cloud & SaaS Incidents Lessons 51–60 • Scenario-driven SOC investigation and decision-making.

Module 6 • Lesson 51 • Planned

The User Downloaded Gigabytes Before Leaving Investigate unusual cloud data access with business context.

Module 6 • Lesson 52 • Planned

The Same Account Accessed SharePoint from Two Countries Evaluate location anomalies carefully.

Module 6 • Lesson 53 • Planned

Hundreds of Files Were Downloaded in Minutes Measure bulk data access and compare it with normal behaviour.

Module 6 • Lesson 54 • Planned

The OAuth Application Was Granted Consent Investigate cloud persistence through consent.

Module 6 • Lesson 55 • Planned

The Application Accessed Data Without the User Follow non-interactive application access.

Module 6 • Lesson 56 • Planned

The Account Shared a Sensitive File Externally Investigate external sharing and exposure.

Module 6 • Lesson 57 • Planned

The Cloud Alert Had No Endpoint Evidence Work an incident where evidence exists only in cloud services.

Module 6 • Lesson 58 • Planned

The Activity Crossed Entra, Exchange and SharePoint Follow one identity across Microsoft cloud workloads.

Module 6 • Lesson 59 • Planned

Was This Insider Activity or Account Compromise? Compare competing hypotheses using evidence.

Module 6 • Lesson 60 • Planned

Building the Complete Cloud Compromise Timeline Create a defensible cross-service timeline.

Module 7 — Incident Response: Containment, Evidence & Escalation Lessons 61–70 • Scenario-driven SOC investigation and decision-making.

Module 7 • Lesson 61 • Planned

The Investigation Became an Incident Recognise the transition from analysis to coordinated response.

Module 7 • Lesson 62 • Planned

Do We Isolate the Device Now? Balance containment urgency against business impact and uncertainty.

Module 7 • Lesson 63 • Planned

Do We Disable the Account? Assess identity containment options and consequences.

Module 7 • Lesson 64 • Planned

What Evidence Must We Preserve? Identify telemetry and artefacts that matter before remediation.

Module 7 • Lesson 65 • Planned

The Attack Was Still Active Prioritise containment when malicious activity continues.

Module 7 • Lesson 66 • Planned

The Incident Crossed Multiple Teams Coordinate identity, endpoint, messaging, cloud and business stakeholders.

Module 7 • Lesson 67 • Planned

The Scope Kept Growing Reassess affected entities as evidence expands.

Module 7 • Lesson 68 • Planned

When Do We Call It Contained? Define evidence-based containment.

Module 7 • Lesson 69 • Planned

Writing the Incident Handover Transfer status, evidence, actions and unanswered questions.

Module 7 • Lesson 70 • Planned

From Detection to Recovery — Run the Incident Work the full response lifecycle.

Module 8 — Threat Hunting: Looking Beyond the Alerts Lessons 71–80 • Scenario-driven SOC investigation and decision-making.

Module 8 • Lesson 71 • Planned

The Hunt Started with a Behaviour, Not an IOC Form a behavioural hypothesis instead of waiting for an indicator.

Module 8 • Lesson 72 • Planned

One Query Found the Same Technique on Twelve Devices Scope one behaviour across the environment.

Module 8 • Lesson 73 • Planned

The Alert Was Quiet — The Hunt Wasn't Use proactive hunting to find related activity.

Module 8 • Lesson 74 • Planned

What Does Normal Look Like Here? Build a baseline before declaring an anomaly.

Module 8 • Lesson 75 • Planned

The Baseline Changed Separate legitimate drift from attack behaviour.

Module 8 • Lesson 76 • Planned

Three Weak Signals Became One Strong Lead Combine weak behaviours into a stronger hunting candidate.

Module 8 • Lesson 77 • Planned

The Hunt Found Nothing — Was It Still Useful? Treat negative findings as evidence without overstating them.

Module 8 • Lesson 78 • Planned

The IOC Changed — The Behaviour Didn't Build hunts that survive infrastructure changes.

Module 8 • Lesson 79 • Planned

The Hunt Needs Another Data Source Recognise telemetry limits.

Module 8 • Lesson 80 • Planned

Turn the Successful Hunt into Team Capability Package a hunt so another analyst can repeat it.

Module 9 — Detection Engineering: Turning Findings into Protection Lessons 81–90 • Scenario-driven SOC investigation and decision-making.

Module 9 • Lesson 81 • Planned

This Investigation Should Become a Detection Recognise repeatable malicious behaviour worth operationalising.

Module 9 • Lesson 82 • Planned

The Detection Generated Too Many False Positives Tune noise without deleting the security hypothesis.

Module 9 • Lesson 83 • Planned

Build a Baseline Before Setting the Threshold Use historical behaviour to justify thresholds.

Module 9 • Lesson 84 • Planned

The Detection Looked Good Until We Backtested It Test logic against historical telemetry.

Module 9 • Lesson 85 • Planned

The Detection Fired 600 Times a Day Measure analyst workload and group repeated events.

Module 9 • Lesson 86 • Planned

The Threshold Hid a Real Attack Understand the false-negative cost of tuning.

Module 9 • Lesson 87 • Planned

The Detection Duplicated Another Rule Reduce redundant analyst work while preserving coverage.

Module 9 • Lesson 88 • Planned

The Environment Changed After Deployment Monitor drift and revisit assumptions.

Module 9 • Lesson 89 • Planned

Can Another Analyst Explain Why This Alert Fired? Build transparent, explainable detections.

Module 9 • Lesson 90 • Planned

From Hunt to Production Detection Complete the detection-engineering lifecycle.

Module 10 — Complete SOC Investigation Scenarios Lessons 91–100 • Scenario-driven SOC investigation and decision-making.

Module 10 • Lesson 91 • Planned

Monday 09:02 — The Queue Is Already Full Run a realistic shift-opening triage scenario.

Module 10 • Lesson 92 • Planned

The Phishing Email Became an Identity Incident Follow one case across email and identity.

Module 10 • Lesson 93 • Planned

The Identity Incident Reached the Endpoint Correlate compromise with process and device activity.

Module 10 • Lesson 94 • Planned

The Endpoint Incident Became Lateral Movement Scope movement to additional devices.

Module 10 • Lesson 95 • Planned

The Cloud Data Started Leaving Investigate cross-service exfiltration.

Module 10 • Lesson 96 • Planned

The Executive Account Was Compromised Handle high-impact identity risk and escalation.

Module 10 • Lesson 97 • Planned

The Ransomware Alert Was Only the Middle of the Story Reconstruct activity before and after the loudest alert.

Module 10 • Lesson 98 • Planned

The Insider-Threat Hypothesis Was Wrong Change direction when evidence disagrees with the theory.

Module 10 • Lesson 99 • Planned

The Night Shift Needs a Complete Handover Produce a defensible handover for an unfinished incident.

Module 10 • Lesson 100 • Planned

Your Final SOC Investigation Triage, investigate, scope, contain, document and close a multi-stage incident.

What makes this SOC Analyst Academy different?

This academy connects the existing Agent Foskett technical learning paths and puts the learner in the analyst's chair.

Scenario-first learningLessons begin with an alert, incident or investigative problem and teach the analyst how to reason through it.

Cross-product investigationsMove between Defender XDR, Sentinel, Entra, endpoint, email, cloud and KQL as the evidence requires.

Built for real analyst decisionsLearn when to pivot, when to stop, when to contain, when to escalate and how to explain the evidence.

Supporting Agent Foskett academies

Use the specialist academies whenever a SOC investigation requires deeper technical knowledge.

KQL AcademyLearn practical KQL for Defender XDR, Sentinel, advanced hunting and investigation timelines.

Microsoft Sentinel AcademyLearn incidents, analytics rules, hunting, entity mapping, automation, workbooks and response workflows.

Microsoft Entra Security AcademyExplore sign-ins, identity protection, MFA, Conditional Access, PIM and identity governance.

Defender for Endpoint AcademyInvestigate devices, timelines, processes, network activity, Live Response, isolation and remediation.

Defender for Cloud AcademyExplore cloud posture, workload protection, attack paths, security alerts and cloud incident response.

Security Copilot AcademyUse AI-assisted triage, incident summaries, threat hunting and investigation workflows with analyst validation.

Defender XDR Investigation WorkflowReview the existing end-to-end Microsoft Defender XDR investigation workflow.

Building an Incident TimelineLearn how to turn separate security events into one chronological investigation story.

Main Academy PortalReturn to the complete Agent Foskett Academy hub covering all Microsoft security learning paths.

Final thought

Security tools generate evidence. Analysts turn that evidence into decisions.

The logs already knew.The SOC Analyst Academy teaches you how to decide which logs matter, what the evidence supports and what should happen next.

Agent Foskett SOC Analyst Academy

Agent Foskett SOC Analyst Academy is a 100-lesson Microsoft Security Operations learning path covering SOC alert triage, incident investigation, identity security, endpoint incidents, phishing, cloud and SaaS investigations, incident response, threat hunting and detection engineering.

Learn Microsoft Security Operations

Learn practical SOC analyst workflows using Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra, KQL, Defender for Endpoint, Defender for Cloud and Microsoft Security Copilot.

Scenario-driven SOC analyst training

The learning path uses realistic security incidents to teach prioritisation, evidence collection, investigation pivots, containment, escalation, handover and defensible conclusions.