Preparing for a Tier-1 or Tier-2 SOC Analyst technical interview requires deep operational knowledge of SIEM log triage, threat hunting methodologies, and containment playbooks.
1. How do you distinguish between a False Positive and a True Positive alert in SIEM?
A True Positive occurs when an alert correctly identifies malicious activity (e.g., suspicious PowerShell execution downloading an external payload). A False Positive occurs when benign operational behavior triggers a rule (e.g., an IT administrator running a legitimate remote deployment script).
# Sample Sysmon Incident Response Query for Event ID 1 (Process Creation)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} |
Where-Object {$_.Message -match "powershell.exe" -and $_.Message -match "-EncodedCommand"}2. What are the key stages of the NIST SP 800-61 Rev 2 Incident Response Lifecycle?
The 4 phases are: Preparation, Detection & Analysis, Containment Eradication & Recovery, and Post-Incident Activity (Lessons Learned).