SOC / Blue Team
What Does a SOC Analyst Do? L1, L2 and L3 Explained
By the Best Cybersecurity Training in Hyderabad training team · Updated · 7 min read
Short answer
A SOC analyst monitors security alerts, decides whether each one represents real malicious activity, investigates the ones that do, and escalates with context. L1 analysts triage, L2 analysts investigate in depth, and L3 analysts handle complex incidents, hunt threats and improve detections.
A typical shift
Most of the job is triage: an alert fires, you gather context from logs and endpoint data, and you decide whether it is a true positive. The majority of alerts are benign, and documenting why you closed them is part of the work.
L1, L2 and L3 compared
- L1 — monitors the queue, validates alerts, follows playbooks, escalates
- L2 — investigates escalations across data sources, scopes incidents, begins containment
- L3 — leads complex incidents, hunts proactively, writes and tunes detections
Tools you will use
A SIEM such as Splunk or Elastic for searching and correlating logs, an EDR for endpoint visibility, a ticketing or case management system, and frameworks such as MITRE ATT&CK to describe what an alert represents.
Skills that matter most
Networking and operating system fundamentals, the ability to read logs, structured thinking under time pressure, and clear written communication. Tool knowledge can be learned on the job; the fundamentals are expected on day one.