Good morning, Analyst.
You're on Shift B · SOC-1. Overnight brought 27 alerts — 3 need you now. Priority: High.
Shift modeOn watch
Analyst rank
Investigator
Blue Team · Tier 2 triage
Clearance L3 · Confidential8,420 XPNext: Specialist · 4,080 to go
Daily objectives 3 / 5
Clear the overnight critical queue+50
Extract IOCs from INC-2291+40
Map one incident to ATT&CK+30
Submit an analyst report+80
Complete one hands-on lab+100
Weekly goal
Resets Sunday · keep the streak alive
Active investigations · case queue Open queue
Encoded PowerShell — active C2 on finance subnet
INC-2291 · FIN-WKS-04 · EDR · conf 96%
crit14m 00s
Ransomware canary triggered on file server
INC-2290 · SRV-FS-02 · File integrity · conf 91%
crit22m 00s
LSASS memory access by unsigned process
INC-2288 · HR-WKS-12 · Sysmon EID 10 · conf 88%
crit17m 00s
Impossible travel — Lagos then Toronto in 22 min
INC-2287 · m.ortega@corp · Azure AD · conf 74%
warn41m 00s
Business email compromise — mailbox rule created
INC-2286 · j.park@corp · M365 · conf 69%
warn50m 00s
Kerberoasting — abnormal TGS requests
INC-2284 · DC-01 · Windows Security · conf 77%
warn45m 00s
Suspicious scheduled task registered at boot
INC-2283 · ENG-WKS-08 · Sysmon EID 1 · conf 63%
warn55m 00s
DNS tunneling to newly-registered domain
INC-2278 · ENG-LNX-11 · Zeek · conf 61%
info2h 10m
Regular beaconing to low-reputation host
INC-2274 · MKT-WKS-03 · Firewall · conf 54%
info2h 30m
Streak
23 days
Longest: 41 · +25 XP/day
Skill radar
SOC performance · 7 days
6m 12s▼18%
Mean time to triage
94%▲3%
Triage accuracy
147▲12
Alerts triaged
2.1%▲0.4%
False-positive rate
AI mentor
Aestrea Coach
Adaptive · intermediate
“Before you close INC-2291 — what does a Word document spawning encoded PowerShell suggest about the initial access vector?”
Resume with mentorCertifications
Aestrea Certified SOC Analyst
ACSA · earned Apr 2026
Incident Response Practitioner
AIRP · in progress · 60%