Learn to work a SOC alert.
Hands-on SOC analyst training in your browser: real logs, real cases, and a free path from your first lesson to your first shift.
- SOC Analyst path, free end to end
- Free cases to work
- Runs in your browser
- 800+ members
Multi-User VPN Failures Then Success
Triggered 2026-03-06 11:18:04 EST · VPN Auth
Several users failed from one IP. Then something changed. Tap the line that turns this from noise into an incident.
Come back and the next lesson is waiting.
Pick where you’re headed and the Atlas lays it out in order. The SOC Analyst path runs from how a computer works to your first shift, and every step of it is free.
- Short lessons, with checks you answer as you go.
- Security+, Network+ and A+ paths when you want the cert.
- Done means done. Your record keeps every step.
Everything a SOC analyst touches, in nine zones.
We’re building the Atlas into a complete library of the job, zone by zone, from how a computer works to reverse engineering malware. Free content ships first, so the free side keeps growing.
- Zone 1
Foundation & IT Core
Foundations → A+ Core 1 → A+ Core 2
How Computers Work, Operating System Basics, Network Foundations
- Zone 2
Networking & Infrastructure
What Is The Network+?, Networking Concepts, Network Implementation
- Zone 3
Systems & Identity
Linux and Windows basics → Administer and harden → Active Directory
Linux Basics for Security, Linux System Administration, Security-Focused Linux Skills
- Zone 4
Security Principles
Careers in cyber → Security+
Security+ Overview, General Security Concepts, Basic Cryptography
- Zone 5
Programming & Automation
Python → Scripting for analysts
PowerShell for Security, Python Environment Setup, Python Basics
- Zone 6
Detection & Security Engineering
Telemetry → SIEM → Cloud and automation
Introduction to Logs & Events, SIEM Fundamentals, Introduction to SPL
- Zone 7
SOC Investigation & IR
Working the queue → Investigate by evidence type
Season Zero: First Shift, Season One: Escalation, Inside the SOC: Roles, Shifts, Tooling
- Zone 8
Threat Intel & Hunting
What Threat Intelligence Is, The Intelligence Cycle, IOCs & the Pyramid of Pain
- Zone 9
Malware & Reverse Engineering
Introduction to Malware Analysis
Guided paths
- SOC Analyst · Level 1Free
- Threat Intelligence AnalystFree
- SOC Analyst · Level 2Premium
- CompTIA A+ · 220-1101 & 220-1102Free to start
- Security+ · SY0-701Free to start
- Network+ · N10-009Free to start
- Linux for SOCFree
- Cloud SecurityFree to start
Then work the whole case.
What you just did is the first minute of a case. The rest is yours: search the logs, pin the events that prove it, record the indicators, make the call, and get it reviewed. The free cases open as you learn.
No homelab. No VM. It runs in the tab you’re in.
See the cases- ED-101Open Enrollment Benefits NoticeEmail · 10-15 min · free
- ED-102Straylight Payments Lookalike DomainThreat intel · 15-20 min · free
- ED-103Shared Hosting Pivot on Payment Fraud IPThreat intel · 10-15 min · free
- ED-104VPN Auth Spray Against Treasury StaffSIEM · 10-15 min · free
- ED-105Macro Click on ws-fin-01Endpoint · 10-15 min · free
Your first week was supposed to be easy.
Season Zero is five episodes of one incident that keeps growing, 3-4 hours in all. Play it if you want to feel the job before you commit to a path. It’s free, and it’s step 15 of the SOC Analyst path.
- 01First Day30-40 min
- 02Inbox Zero40-50 min
- 03Follow the Thread40-50 min
- 04Lateral40-50 min
- 05Containment40-50 min
Proof you can show, and the cert when you need it.
Every lesson pays. Every award has a receipt.
- Lesson complete+10 XP
- Module complete+10 XP
- Case closed+40 XP
Exam prep, scored by domain.
Timed simulators for Security+, Network+ and A+, flashcards by domain, and a dated 30-day Security+ plan.
Start free. Stay free as long as you like.
The SOC Analyst path, Season Zero and the free cases cost nothing. Premium adds the rest.
The whole SOC Analyst path, the first modules in most zones, Season Zero, the free cases, recall, your record.
Start freeNo card. Progress is kept if you upgrade later.Every module in every zone, the Security+, Network+ and A+ paths, every case, the exam simulators, Season One.
Start the trialCancel any time. You keep everything you finished.Fair questions.
Do I need any experience?
No. The SOC Analyst path starts at "How Computers Work" and builds through networking, the command line and security basics before it reaches the SOC. If you can use a browser, you can start today.
How is this different from TryHackMe or Hack The Box?
They train the attacker. This trains the person who catches the attacker: reading logs, triaging alerts, writing detections, working an incident.
Will it help me get hired?
It trains what interviewers test: alert triage, email analysis, log correlation, incident response. The cases give you investigations to talk through, and your record shows what you actually did.
What is free?
The whole SOC Analyst path, Season Zero, the free cases, recall and your record. Free content ships first, so that list keeps growing. No card to start.
I am already an analyst. Is this too basic?
Skip ahead. Prerequisites are advice, not gates, so open Detection or Malware directly, or go straight to the cases.
Your next alert is waiting.
Lesson one takes ten minutes: “CPU, Memory, and the Fetch-Execute Cycle”.