On November 14, 2025, a 200-bed regional healthcare provider in Ohio faced a coordinated LockBit 4.0 phishing campaign. The initial payload bypassed the email gateway, but the endpoint detection and response platform flagged an anomalous PowerShell execution at 06:14 AM. When junior engineers ask me about the role, I tell them, "What Does a SOC Analyst Do?" A Day in the Life of a Security Operations Center Analyst is rarely just staring at a dashboard. It is about executing precise, high-stakes triage under pressure. In those critical 14 minutes before the threat actor could establish persistence, the Tier 2 analyst isolated 300 endpoints, halting MITRE ATT&CK T1059.001 (Command and Scripting Interpreter: PowerShell) in its tracks. This is the reality of modern security operations.

Actionable Takeaway: Stop viewing the SOC as a passive monitoring center; treat it as an active defensive unit capable of executing autonomous containment within minutes of initial compromise.

What Does a SOC Analyst Do? A Day in the Life of a Security Operations Center Analyst During Morning Triage

The shift begins at 06:00 AM with a mandatory handover protocol. I never rely on verbal updates alone. The incoming analyst reviews the overnight queue in Splunk Enterprise Security, specifically filtering for alerts that exceeded the baseline noise threshold. We prioritize tickets based on asset criticality and data classification. A critical alert on a domain controller immediately jumps to the top of the queue, while a low-fidelity alert on a guest Wi-Fi kiosk is deprioritized. This aligns directly with NIST SP 800-61 Rev 2 (Computer Security Incident Handling Guide), which mandates that detection and analysis must be scaled according to the potential impact on the organization's core mission.

During this phase, the analyst is not just reading alerts; they are validating telemetry. I often see junior analysts close a ticket because the endpoint antivirus reported: "clean." That is a dangerous assumption. I train my team to cross-reference the EDR process tree with the firewall proxy logs. If the antivirus missed a fileless injection, the network telemetry will still show an unexpected outbound connection to a known command-and-control infrastructure IP. Validating these multiple data sources is the core of effective triage.

Actionable Takeaway: Standardize shift handover protocols using structured digital runbooks to ensure critical overnight context and pending investigations are not lost during analyst transitions.

Deep Dive Investigation: Mapping Adversary Behavior

Once an alert is escalated from Tier 1 to Tier 2, the real investigation begins. Let us look at a common scenario: a suspicious Windows Event ID 4624 indicating a Type 10 (Remote Interactive) logon via RDP from an unexpected internal subnet. The analyst must determine if this is legitimate administrative activity or MITRE ATT&CK T1078 (Valid Accounts) being leveraged for lateral movement.

To confirm the attack, I instruct my analysts to hunt for credential dumping. We query the endpoint telemetry for MITRE ATT&CK T1550.002 (Use Alternate Authentication Material: Pass the Hash). This requires deep visibility into process execution and memory access. Adhering to ISO 27001:2022 Annex A 8.15 (Logging) and Annex A 8.16 (Monitoring activities), we ensure that Sysmon is configured to capture Event ID 10 (ProcessAccess). Below is the exact PowerShell query I use to hunt for non-system processes attempting to read the memory of the Local Security Authority Subsystem Service (LSASS).

# PowerShell query to hunt for LSASS memory access (MITRE ATT&CK T1003.001)
# Requires Sysmon Event ID 10 logging enabled

$Query = @"

  
    
      *[System[(EventID=10)]]
      and
      *[EventData[Data[@Name='TargetImage'] and (Data='C:\Windows\system32\lsass.exe')]]
      and
      *[EventData[Data[@Name='CallTrace'] and not (Data contains 'C:\Windows\System32\ntdll.dll')]]
    
  

"@

Get-WinEvent -FilterXml $Query -MaxEvents 50 | Select-Object TimeCreated, 
    @{Name='SourceProcess';Expression={$_.Properties[5].Value}}, 
    @{Name='TargetProcess';Expression={$_.Properties[4].Value}}

If this query returns a hit from an unexpected process like taskmgr.exe or a custom PowerShell script, the analyst has confirmed credential theft. The investigation immediately shifts from a potential false positive to an active containment scenario.

Actionable Takeaway: Never trust a single telemetry source; always correlate identity logs with endpoint process execution to definitively confirm lateral movement and credential theft.

Incident Response Execution and Containment Playbooks

When an analyst confirms a breach, the clock starts ticking. Following NIST SP 800-53 Rev 5 control IR-4 (Incident Handling), the analyst must execute containment without tipping off the adversary or destroying critical forensic evidence. In my environment, we do not rely on manual network cable pulls. The analyst uses the EDR console to execute a network isolation command. This severs the endpoint's connection to the corporate LAN and the internet, while maintaining a secure, out-of-band tunnel to the EDR management server for continued forensic collection.

Simultaneously, the analyst must invalidate the compromised session. I require my team to force a global sign-out in Microsoft Entra ID for the compromised user account. This instantly revokes all active access tokens and refresh tokens, preventing the attacker from using stolen cookies to maintain persistence. We then reset the user's password and enforce a re-registration of their MFA device. This rapid, automated containment is what separates a minor security event from a headline-making data breach.

Actionable Takeaway: Pre-authorize network isolation and global sign-out capabilities in your EDR and identity consoles so analysts can instantly contain a threat without waiting for management approval during an active breach.

Comparative Analysis of SOC Analyst Tiers

The following matrix breaks down the operational realities, tooling, and focus areas across the three primary tiers of a mature Security Operations Center.

Actionable Takeaway: Clearly define the escalation criteria between tiers to prevent Tier 1 burnout and ensure Tier 3 engineers have the uninterrupted time required for proactive threat hunting.

Shift Handover, Documentation, and Continuous Tuning

The final phase of the analyst's day is often the most neglected: documentation and tuning. NIST SP 800-53 Rev 5 controls IR-6 (Incident Monitoring) and IR-8 (Incident Response Plan) require that every security event is thoroughly documented. The analyst must write a comprehensive incident report detailing the timeline, the indicators of compromise, and the exact containment actions taken. This report becomes the foundation for any subsequent legal or regulatory review.

Beyond documentation, the analyst must tune the detection logic. If a specific SIEM rule generated 50 false positives during the shift, the analyst cannot just close the tickets and walk away. They must analyze the root cause of the false positives, identify the legitimate business process triggering the alert, and update the SIEM correlation rule to exclude that specific process. This continuous feedback loop is what matures a SOC from a reactive alert factory into a proactive defense engine.

Actionable Takeaway: Treat every closed ticket as an opportunity to tune detection logic, ensuring the same alert does not trigger unnecessary manual work and analyst fatigue the following week.