nabeel323 / soc-roadmap

What is soc-roadmap?

soc-roadmap is a GitHub repo delivering a complete roadmap for cyber security newbies aiming to become SOC analysts, from IT basics like networking and OS fundamentals to advanced threat hunting, detection engineering, and SOC automation with Python scripts. It breaks down real-world workflows—SIEM triage in Splunk or Sentinel, KQL/SPL queries, MITRE ATT&CK mapping, and investigations into MFA fatigue or beaconing—solving the chaos of scattered cyber security learning paths. Users get phased guides, lab recs like TryHackMe, cert paths from Security+ to GCIH, and planned additions like KQL cheat sheets.

Why is it gaining traction?

It stands out with hyper-specific SOC scenarios like impossible travel alerts or OAuth abuse, plus daily routines and automation projects like IOC enrichers, unlike generic roadmaps. The focus on practical tools—Wireshark, Elastic, Microsoft Defender—hooks devs wanting hands-on blue team skills without fluff. Early buzz comes from its promise of real investigation timelines and contrib invites.

Who should use this?

Aspiring SOC analysts starting from zero cyber security knowledge, blue teamers sharpening SIEM skills, or threat hunters building KQL detections. Ideal for IT pros transitioning via labs like CyberDefenders, or detection engineers mapping MITRE tactics to alerts.

Verdict

Solid starter for a SOC analyst roadmap on GitHub, but at 19 stars and 1.0% credibility, it's raw—mostly one doc with future plans, no code yet. Grab it if you're motivated to contribute; skip for polished alternatives until it matures.

(178 words)