SOC Analyst Level 3: Detection Engineering Playbook

Description

One of the best SOC books for senior analysts. 427 pages on detection engineering, threat hunting, Active Directory, cloud security and incident response.

SOC Analyst Level 3: The Detection Engineer’s Playbook is a 427-page field manual for analysts who have outgrown the alert queue. Written by Rocky and published by Codelivly, it is the third and final volume in the SOC Analyst series — and the one that covers the work most SOC books never reach: detection engineering, adversary-domain depth, and enterprise incident command.

Level 1 taught you to triage. Level 2 taught you to hunt. Level 3 teaches you to decide what the queue contains in the first place.

Most cybersecurity books stop at explaining what a technique is. This one assumes you already know, and moves to the harder question: what invariant behaviour does that technique require, what telemetry proves it, and what rule catches it when the adversary changes tools tomorrow?

---

The gap this book closes

There is a specific ceiling that competent analysts hit. You can investigate anything handed to you. You can pivot, cluster, and write a clean escalation. And then someone asks you to build the detection — and there is no runbook for that, because writing detections is a different discipline from running them.

That gap is where careers stall. It is also where this book lives.

You will finish it able to:

• Derive detection logic from raw telemetry with no hint of what the attack was
• Write the same rule correctly in Sigma, Splunk SPL, Microsoft Sentinel KQL, Elastic EQL and Wazuh, and know where each platform’s syntax will silently fail you
• Run detection-as-code with Git, CI, automated testing and measured precision
• Investigate Active Directory attack paths from Kerberoasting through DCSync to Golden Ticket
• Investigate cloud identity compromise in AWS CloudTrail, Microsoft Entra ID, M365 and GCP
• Command an enterprise incident using eight ready-to-run response playbooks
• Automate the work that does not need judgment — and recognise the three things you must never automate

---

What makes this different from other SOC books

Three things, concretely.

1. Detection logic on five platforms, not one. Vendor-specific books teach you one query language and leave you stranded when you change jobs. This book writes every significant detection in multiple dialects and explains the translation traps — why EQL’s : and == behave differently on filenames, why KQL’s in is case-sensitive, why a Wazuh rule with a mismatched field name fails silently and never errors.

2. A full chapter where the answer is withheld. Chapter 12, The Detection Lab, hands you raw Windows event logs, Linux auditd records, packet captures and CloudTrail extracts with no explanation of what the attack is. You derive the technique, write the rule, and check yourself against the answer key in Appendix C. This is the exercise that separates an analyst who can read a detection from one who can write it.

3. Nine intrusions reconstructed end to end. Chapter 13 walks nine enterprise breaches from initial access to lessons learned — ransomware, identity-only espionage, npm supply chain, insider theft, web shell and card skimming, cryptomining, credential stuffing, business email compromise, and a destructive attack on a utility. Each has a timeline, the artefacts recovered, the log evidence, and an honest audit of every detection opportunity that was missed and why.

🚀 Practice What You Learn

Reading is just the beginning. Reinforce your skills with hands-on, browser-based cybersecurity labs at codelivly.com/labs. Practice real-world scenarios, complete guided challenges, and build practical experience alongside this book.

---

What’s inside, by the numbers

Pages	427
Chapters	15, plus 4 appendices
Hands-on labs and exercises	37
Enterprise case studies	9
Incident response playbooks	8
Diagrams	21
Reference tables	149
Code and query blocks	311
Sigma rules	25
Splunk SPL queries	129
Sentinel KQL queries	22
PowerShell scripts	31
Bash / Linux command blocks	54
Python automation scripts	11
YARA rules	4
Interview questions	87
Field notes, common mistakes and troubleshooting boxes	82

Full table of contents

Part One — Foundations

1. Modern Security Operations Centers — SOC generations, the L1/L2/L3 escalation contract, the detection lifecycle, telemetry ranking, metrics that matter
2. Advanced Windows Event Analysis — audit policy, Sysmon, logon types, Kerberos ticket events, process trees, LSASS access masks, PowerShell script block logging, lateral movement signatures
3. Advanced Linux Investigation — auditd rulesets, auid versus uid, SSH forensics, eight persistence locations, live triage, container and cloud signals

Part Two — Building Detection 4. Detection Engineering — detection specifications, Sigma anatomy, YARA, the four tuning strategies, detection-as-code with CI/CD 5. Threat Hunting — the Hunting Maturity Model, six methodologies, hypothesis structure, stack counting, beacon and DNS tunnel detection, super timelines 6. Enterprise Log Correlation — entity resolution, join tables, four correlation patterns, risk-based alerting, the six investigation pivots

Part Three — The Adversary Domains 7. Active Directory Attacks and Detection — LDAP reconnaissance, Kerberoasting, AS-REP roasting, DCSync, ACL abuse, Shadow Credentials, RBCD, ADCS, Golden and Silver tickets 8. Enterprise Incident Response Playbooks — PICERL with decision gates, evidence handling, order of volatility, eight complete playbooks, post-incident review 9. Malware Investigation and Persistence Analysis — static triage, the complete Windows persistence map, DLL sideloading, obfuscated PowerShell, LOLBins, memory indicators 10. Threat Intelligence for SOC Operations — the four tiers, indicator scoring and decay, MISP workflow, enrichment APIs, producing intelligence from your own incidents 11. Cloud Security Monitoring and Investigation — AWS CloudTrail, Entra ID and M365, GCP audit logs, cloud persistence, IMDS credential theft, cloud incident response

Part Four — Applied Practice 12. The Detection Lab — seven derive-it-yourself exercises with no answers given up front 13. Enterprise Case Studies — nine full intrusions with cross-case failure patterns

Part Five — Scale and Career 14. Automation for the SOC — the automation decision matrix, enrichment pipelines, SOAR playbook design, scope guards and circuit breakers 15. Becoming a Senior SOC Analyst — an honest skills matrix, a twelve-month plan, portfolio projects, certification assessment, résumé and interview preparation

Appendices

• A — Field reference and cheat sheets: Windows and Sysmon event IDs, logon types, Kerberos encryption types, LSASS masks, LOLBins, registry paths, cloud log sources
• B — Complete six-VM lab environment build guide
• C — Answer key for every Chapter 12 exercise
• D — Consolidated glossary

Who this book is for

• SOC analysts at Level 2 moving toward Level 3 or senior
• Detection engineers building and maintaining rules at scale
• Threat hunters who want reproducible methodology instead of intuition
• Incident responders working enterprise-scale intrusions
• Blue team and DFIR practitioners preparing for GCIH, GCFA, GCDA, BTL2 or CySA+
• SOC leads defining what their team’s detection coverage should be

Who this book is not for

If you are new to security, start with SOC Analyst Level 1: The Practical Playbook. If you can triage but cannot yet cluster alerts into a campaign, read SOC Analyst Level 2: The Threat Hunter’s Playbook first. Level 3 assumes you already read logs fluently, know your way around a SIEM, and have run at least one real investigation start to finish.

Built for defenders only

Every technique in this book is presented from the defender’s side. Attacker artefacts appear only as things to recognise in telemetry. Laboratory work uses published, safe emulation frameworks — Atomic Red Team, CALDERA, Splunk Attack Data and public DFIR datasets — run only in an isolated lab you own. All organisations, hostnames and addresses in the case studies are fictional, using RFC 5737, RFC 3849 and RFC 2606 documentation ranges.

Format: DRM-free PDF. Instant download. Yours forever, with free updates.

4. FAQ

What is the difference between SOC Analyst Level 1, Level 2 and Level 3?

Level 1 covers alert triage and the daily reality of the queue. Level 2 covers threat hunting, alert clustering and campaign tracking. Level 3 covers detection engineering, Active Directory and cloud investigation, enterprise incident command, and SOC automation. Put simply: L1 answers the alerts, L2 investigates them, L3 decides which alerts exist at all.

	Level 1	Level 2	Level 3
Core question	Is this real?	What happened?	What are we missing?
Primary skill	Triage	Hunting and clustering	Detection engineering
Output	Verdict and escalation	Incident narrative	Detections, playbooks, architecture
Read it when	You are new to the SOC	You can triage but not hunt	You can investigate but not build

Do I need to know how to code to read this book?

No, but you will get more from it if you can read Python and PowerShell. The book contains 11 Python scripts and 31 PowerShell blocks, all fully commented and explained line by line. The detection logic itself — Sigma, SPL, KQL, EQL — is query language, not programming, and the book teaches it from the ground up.

Which SIEM does this book use?

All the major ones. Detections are written in Sigma as the vendor-neutral source, then translated to Splunk SPL, Microsoft Sentinel KQL, Elastic EQL and Wazuh, with the platform-specific pitfalls explained. If your SIEM is not listed, Sigma converts to most others through sigma-cli.

Is this book good for GCIH, GCFA, BTL2 or CySA+ preparation?

It is not an exam-prep book and does not follow any certification syllabus. It is, however, closely aligned with the practical skills those certifications test — evidence handling, incident command, detection authoring, forensic timeline construction and adversary emulation. Analysts preparing for hands-on certifications generally find it more useful than exam guides; analysts who only need to pass a multiple-choice test should buy an official study guide instead.

Does it cover cloud security?

Yes. Chapter 11 covers AWS CloudTrail investigation, Microsoft Entra ID and M365 audit logs, GCP Cloud Audit Logs, cloud-specific persistence such as backdoor access keys and role trust modification, instance metadata credential theft, and how cloud incident response differs from on-premises. Two of the nine case studies are cloud intrusions.

Can I follow along without a lab?

Yes. Appendix B contains a complete six-VM lab build guide with every command. But every lab also includes a Dataset Fallback using free public datasets — Splunk Attack Data, Mordor, EVTX-ATTACK-SAMPLES, Malware-Traffic-Analysis.net, CyberDefenders and flaws.cloud — so you can complete the exercises on a laptop with no lab at all.

Is there an answer key?

Yes. Appendix C contains worked solutions for all seven Chapter 12 exercises, including the reasoning, not just the final rule. Selected practice questions from other chapters are answered as well.

What format is the book, and do I get updates?

A DRM-free PDF, readable on laptop, tablet or phone, delivered the moment payment clears and stored in your account’s Downloads tab permanently. When the playbook is revised you receive the update free.