First off, thank you for considering contributing! This repository aims to be a comprehensive resource for the LetsDefend SOC Analyst path, and your input helps make it better for the entire blue team community.
If you have completed a LetsDefend lab or challenge that isn't already covered:
- Follow the existing folder structure:
SOC/MD Files/[Module Name]/. - Ensure your write-up includes:
- Alert/Scenario Description: What was the initial trigger?
- Investigation Steps: Detail your process in the EDR, Log Management, and SIEM.
- Analysis: Explain why you reached your conclusion (True Positive vs. False Positive).
- Artifacts: List any IPs, Hashes, or Domains found.
- Place any supporting screenshots in the
SOC/Assetsfolder with clear names.
- Corrections: If you spot a mistake in an investigation step or a technical error in a write-up.
- Clarification: If an explanation is confusing and could be worded better.
- Formatting: Fixing broken links, typos, or Markdown rendering issues.
The SOC field evolves. If you have a more efficient way to investigate a specific alert (e.g., a better Cyber Kill Chain mapping or a more specific MITRE ATT&CK technique), please share it!
- Fork the repository.
- Create a Branch: Use a descriptive name like
feat/new-lab-soc101orfix/typo-phishing-lab. - Commit Your Changes: Provide clear commit messages.
- Push to your fork and Submit a Pull Request.
- Be Professional: Use clear, technical language suitable for a SOC environment.
- Respect Privacy: Never include your personal account credentials or sensitive API keys in screenshots or code snippets.
- Markdown: Use headers (H2, H3) to organize sections and use code blocks for logs/commands.
By contributing, you agree to keep this a helpful, respectful, and collaborative space for all learners.
Note: These write-ups are for educational purposes. Always ensure you are following LetsDefend's terms of service when sharing solutions.