Free Tool
SOC Alert Triage Simulator
A Tier-1 SOC analyst spends the shift doing one thing: deciding which alerts matter. This simulator gives you five synthetic alerts — failed logins, a suspicious process, an odd DNS lookup and more — and asks you to triage each one, exactly as a junior analyst would. All data is invented; the judgement is the real skill.
All data is synthetic and clearly labelled. The IP addresses, hostnames, usernames and log lines in this simulator are invented for teaching. No real organisation, system or person is involved, and nothing here is a live security alert.
What this tool does
A Security Operations Centre, or SOC, watches an organisation's computers around the clock and responds when something looks wrong. The first person an alert reaches is a Tier-1 analyst, whose job is triage: look at the alert, check the context, decide whether it is a real threat, a false alarm or something that needs escalating to a senior analyst. Most alerts are false alarms. The skill is telling the difference quickly, without missing the one that matters.
This simulator gives you five alerts drawn from the kinds of events a real Tier-1 analyst sees every day: repeated failed logins, a process starting from a strange location, an unusual DNS lookup, a login at an odd hour, and a security tool being disabled. For each alert you get the raw details — the event ID, the user, the host, the time — and three possible actions. Choose one, and the simulator explains what a professional would do and why, including which extra checks they would run before deciding.
The simulator is built for people considering a SOC career, which is one of the most common entry routes into cybersecurity. It teaches the core Tier-1 habit: never judge an alert on its own — always check the context first. A failed login at 3 a.m. means something very different for a night-shift worker than for an accountant who never works nights, and a new process is suspicious or normal depending on what the user was doing at the time.
Try it
Read each alert, then choose the action a Tier-1 analyst should take. All data is synthetic.
Alert 1 of 5
Choose an action to see how a Tier-1 analyst would judge this alert.
Score: 0 of 5 — every alert here is synthetic and fictional.
How it works
Good triage follows a pattern. First, read the alert properly: what event fired, on which host, for which user, and when. Second, check the context: is this user supposed to be working now, has this host done this before, is this behaviour normal for this system? Third, decide the priority: does this need an immediate response, more investigation, or can it be closed with a note? The simulator mirrors that pattern by giving you the raw event, a context clue, and three actions that match the real choices an analyst faces.
The five alerts cover the most important Tier-1 patterns. Repeated failed logins (Windows event 4625) can be a password-spraying attack or a user who forgot a password after a reset — the difference is the pattern and the account. A new process (event 4688) in a strange folder is a classic sign of malware, but software updates do the same thing, so the check is the file's location and signature. A DNS lookup to a newly registered domain is a common command-and-control signal, but marketing tools use new domains too. The skill is not memorising answers but learning which question to ask next.
The simulator also teaches the habit that most separates junior analysts from good ones: documenting the decision. Every triage action in a real SOC ends with a note — what you saw, what you checked, why you decided what you did — because the next analyst, or the person reviewing the incident later, needs to follow your reasoning. The explanations after each alert model that habit in a sentence or two.
Limitations
This simulator teaches triage thinking, not the job itself. Real SOC work involves tools you cannot practise here — a SIEM to search logs, an endpoint tool to isolate a host, a ticketing system to track an incident — and real alerts arrive by the hundred, under time pressure, with incomplete information. A good score here means you understand the thinking; it does not mean you are ready to staff a SOC, and no certificate or job is promised by this page.
- All alert data is invented. Real logs contain details — asset owners, business context, threat intelligence — that change the decision, and none of that is present here.
- The correct answers are simplifications. In real triage there is often no single right action, and experienced analysts disagree.
- The simulator covers five alert types. A real SOC sees dozens, and the hardest part of the job is the volume, not any single alert.
Examples
Example 1 — failed logins. Twenty failed logins in five minutes on the account j.chen, from an internal workstation at 09:05, just after a company-wide password reset. The professional judgement: investigate first, not escalate — the timing matches the reset, the source is internal, and one user failing after a reset is the most common false positive in the book. The check is whether the same account is also failing from other hosts, which would change the answer completely.
Example 2 — a process from a strange folder. A process named update.exe starts from a user's Downloads folder on host FIN-042, at 14:20, during working hours. The professional judgement: escalate — legitimate updaters do not run from Downloads, and this is a classic malware hiding place. The extra check is the file's signature and whether the user remembers downloading it; either way, the host should be isolated while the check runs.
Example 3 — an odd login time. A successful login (event 4624) for a.miller at 03:12 from a VPN address in another country, when that user works 09:00–17:00 in the office. The professional judgement: investigate first, starting with whether the user is travelling and whether a second factor was used. A login with a second factor from a known device is very different from a password-only login from a new device, and that one check decides whether this is a trip or a compromise.
Frequently asked questions
What does a Tier-1 SOC analyst actually do all day?
Mostly triage: reading alerts, checking context in the SIEM, deciding what is real, escalating what matters, and documenting every decision. It is detective work with a queue — the job is judgement under volume, not just technical knowledge.
Do I need a degree to become a SOC analyst?
No. Many SOC analysts start from IT support, a help desk, or self-study with a foundational certification and hands-on lab practice. Employers value the ability to read logs and think clearly more than a degree — our careers guide covers realistic routes and timelines.
What are Windows event IDs 4624 and 4625?
4624 is a successful logon and 4625 is a failed logon. They are the two most common events a Tier-1 analyst reads, because almost every account attack shows up first as a pattern of failed logons followed by a success.
How do analysts avoid missing a real attack among false alarms?
By checking context every time — who the user is, what is normal for that host, what else happened at the same time — and by tuning the detection rules so the same false positive does not keep firing. Missing a real alert is the fear every analyst carries, and documentation is how they prove what they checked.
Is this simulator enough to get a SOC job?
No — it teaches the thinking, not the tooling. A real SOC role needs hands-on practice with a SIEM, log analysis and incident handling, ideally in a home lab. Use this simulator to test whether you enjoy the work, then build the practical skills the careers guide describes.