You cannot determine what is suspicious without deeply understanding what a completely normal activity looks like. Last week, I took a massive step forward in my cybersecurity goals by joining the Security Operations Centre (SOC) bootcamp run by Cyber Career Fair (CCF). Paired with an incredible team, we built an isolated three-node IT lab environment, generated controlled activity, analyzed resulting evidence, and carried out security monitoring. To keep our environment safe and isolated, we configured each machine's network adapter to host-only mode. Here is a breakdown of our project: 1. We deployed Windows VM (as our endpoint), Kali-Linux VM (as our controlled security testing node), and an Ubuntu server (as our administrative server) and we verified connectivity using ping. 2. We monitored running services, expected logins, and active processes on the Windows VM to determine what a normal baseline looks like. 3. We put the Principle of Least Privileged and Role Based Access Control(RBAC) into action on our Ubuntu server. We created users, group, tested group memberships, assigned strict directory permissions, and deliberately performed normal logins and controlled failed logins. We analyzed the evidence of our activities on the both VMs based on the logs. 4. We also used Wireshark to capture baseline network traffic like ICMP, DNS, SSH, and HTTP, while identifying the source or destination IP. 5. Using Kali-Linux VM, we ran a controlled Nmap port scan and simulated SSH password brute-force attack against our Ubuntu users account to capture the attack evidence. 6. We compared our baseline during normal system operation against the traffic captured after the simulated attack. This project made me realize that, unusual activity does not automatically mean a malicious attack and evidences does not prove a successful compromise. As an analysts, true detection requires correlating timestamps, source addresses, and connection outcomes. #Cybersecurity #SOCAnalyst #HandsonSOCproject