SOC Analyst: The Complete L1 + L2 + L3 Bundle with 30 Hands-On Labs — From Alert Triage to Detection Engineering

Description

The Complete SOC Analyst Roadmap — Now With the Lab Workbook

Most people trying to build a SOC career assemble it from fragments — a YouTube series here, a certification syllabus there, a textbook that explains what a firewall is. The result is knowing a lot of vocabulary and being unable to do the job.

This bundle is the alternative, and it now closes the last gap: not just the path from your first alert to owning your team’s detection coverage, but the hands-on practice that turns reading into skill. Four parts, written and published by Codelivly — three playbooks that teach the job, and one workbook of thirty real investigations where you actually do it.

The three playbooks

Volume 1 — SOC Analyst Level 1: The Practical Playbook. The field manual for your first SOC role. The 6-Step Triage Loop for investigating any alert in under ten minutes. The Big Five playbooks — phishing, malware, credential attacks, web attacks and insider risk. SIEM mechanics and why alerts lie. Lightweight forensics: exactly what to collect before the IR team arrives. Plus the unwritten rules nobody documents — surviving the night shift, writing for auditors, and working with your L2 without irritating them.

Volume 2 — SOC Analyst Level 2: The Threat Hunter’s Playbook. From ticket-closer to threat hunter. Alert clustering — stitching disparate logs into a single narrative. Escaping the SIEM to find the data vendor tools missed. Agentic SOC automation with Python, FastAPI and LangGraph. Campaign attribution and the Diamond Model, including when to stop attributing. The BLUF framework for translating a technical disaster into executive business risk. And an honest breakdown of GCIH, GCFE, GCTI, CySA+ and eCTHP.

Volume 3 — SOC Analyst Level 3: The Detection Engineer’s Playbook. From responding to detections to writing them. 427 pages across 15 chapters and 4 appendices. Detection engineering with Git, CI and measured precision. Active Directory attack paths from Kerberoasting through DCSync to Golden Ticket. Cloud investigation in AWS CloudTrail, Microsoft Entra ID, M365 and GCP. Eight enterprise incident response playbooks. Nine full intrusions reconstructed end to end. Detection logic in Sigma, Splunk SPL, Microsoft Sentinel KQL, Elastic EQL, Wazuh and YARA — 25 Sigma rules, 129 SPL queries and 22 KQL queries in total.

And the practice layer

The SOC Analyst Hands-On Lab Workbook — 30 Practical Investigation Labs. Over 500 pages, 12 chapters of field briefings, and thirty self-contained cases built on synthetic evidence. Each lab hands you a ticket, the raw telemetry, a set of investigation tasks, a printable analyst worksheet, a scoring rubric, and a full answer key that explains the reasoning, the alternative conclusions, the common mistakes and a model write-up. The thirty labs map straight onto the three volumes: Labs 1–10 are Level 1 triage, Labs 11–20 are Level 2 multi-source hunting, and Labs 21–30 are Level 3 detection and response, ending in an integrated incident scored out of 100. Queries are shown in Splunk, KQL, Elastic and Sigma, and every lab also carries a free offline method, so nothing needs a paid tool. Twenty-seven labs ship with downloadable datasets; the remaining three carry their evidence inline. All entities are fictional and there is no live attack code.

This is what the roadmap was always missing: somewhere to apply each level the moment you have read it, against evidence that behaves like the real thing.

How the levels fit together

Each volume assumes the previous one and refuses to repeat it, so there is almost no overlap — you are not paying three times for the same MITRE ATT&CK introduction. The workbook sits across all three, giving every chapter a place to land.

A 90-day path through the bundle

Days 1–20 — Volume 1 and Workbook Labs 1–10. Work the 6-Step Triage Loop and the Big Five playbooks, then prove each one on the Level 1 labs, closing some cases as benign on purpose.

Days 21–45 — Volume 2 and Workbook Labs 11–20. Run your first hypothesis-driven hunt, cluster a multi-stage alert set into one campaign narrative, and write it up with BLUF. The Level 2 labs give you multi-source cases to cluster.

Days 46–75 — Volume 3, Parts One to Three, and Workbook Labs 21–30. Work the Windows, Linux, Active Directory and cloud chapters, ship your first Sigma rule through CI, and take on the Level 3 detection-and-response labs.

Days 76–90 — Volume 3, Parts Four and Five, and the capstone. Read the nine case studies, then sit the workbook’s final integrated investigation with the answer key closed and score yourself out of 100.

At the end you have a hunt log, a set of version-controlled detections, thirty completed investigation worksheets and a scored capstone write-up — which is a portfolio, not just a reading list.

Who this bundle is for

• Anyone starting a SOC career who wants one path instead of forty tabs
• L1 analysts who can see the ceiling and want the whole route mapped, with somewhere to practise it
• Career changers moving into blue team from IT, networking or helpdesk
• Students and self-learners building a portfolio rather than collecting certificates
• SOC leads onboarding new analysts who want a single reference and a ready-made lab set for the whole team
• Anyone preparing for BTL1, BTL2, CySA+, GCIH, GCDA or GCFA who wants practical depth alongside the syllabus

Not for you if you only need to pass a multiple-choice exam. These are operational field manuals and working labs, not study guides — buy the official cert material instead.

What you get

• Three complete playbooks plus the Hands-On Lab Workbook, all DRM-free PDF, readable on laptop, tablet or phone
• The companion dataset package for the investigation labs
• Instant download the moment payment clears
• Lifetime access in your account’s Downloads tab
• Free updates whenever a playbook or lab is revised
• [Insert your bundle saving vs buying all four separately]

FAQ

Do I need to read the volumes in order?
Yes, ideally. Each level assumes the previous one and deliberately does not repeat it. If you already work in a SOC you can start at Level 2, but Level 1 is short and fills gaps most self-taught analysts do not know they have.

How does the workbook fit with the three books?
It is the practice half of the same roadmap. Read a level in the playbook, then work that level’s labs in the workbook. The thirty labs are grouped to match the three volumes, so the pairing is one to one.

How long does it take to work through everything?
About 90 days at a steady pace alongside a job, following the study plan above. Reading alone is faster; the timeline assumes you complete the labs, which is where the skill transfer happens.

Do I need a home lab or paid tools?
No. Volume 3 includes a six-VM lab guide for those who want it, and the workbook ships its own datasets with a free offline method for every lab, so the exercises are completable on a single laptop at zero tooling cost.

Which SIEM platforms are covered?
Splunk, Microsoft Sentinel, Elastic and Wazuh, with Sigma as the vendor-neutral source format. The workbook shows its queries in Splunk, KQL, Elastic and Sigma as well.

I already own the three playbooks. Is the bundle still worth it?
If you want the practice set, buy the Hands-On Lab Workbook on its own — the bundle only saves money if you need two or more parts.

What format are the files and do I get updates?
DRM-free PDFs plus the dataset download, delivered instantly and stored permanently in your account. Revisions are free for existing buyers.