SOC Foundations

What a SOC Lab Actually Is

Define SOC, SIEM, XDR, telemetry, alerts, triage, investigations, findings, and the purpose of a safe lab.

Kubernetes SOC Field Lab · Practical Security Operations

Domain alignment

SOC FoundationsIncident Response

What this lesson covers

  • What a SOC is
  • Events, alerts, incidents, and findings
  • SIEM and XDR concepts
  • What a safe lab can and cannot prove

The short version

Event: something happened.
Alert: a rule decided the event may matter.
Incident: a security event requiring response.
Finding: documented observation requiring remediation, tuning, or follow-up.

A SOC lab is a controlled environment where you practice security monitoring and investigation workflows. It should generate enough telemetry to practice detection and triage, but it should not become a reckless attack playground or a fake production environment.

A SIEM helps centralize and search security events. XDR usually expands the idea by correlating telemetry and response across endpoints, identities, workloads, cloud services, and other sources. In this lab, Wazuh gives us a practical platform for alert review, agent visibility, and security monitoring workflows.

Analyst note: Not every alert is an incident. Triage is the discipline of deciding what the alert means, what evidence supports it, and what the next action should be.

Lab scope statement

This lab teaches SOC workflow on Kubernetes using Wazuh.
It deploys Wazuh, monitors safe lab workloads, generates benign test events,
investigates alerts, documents findings, and practices cleanup.

This lab will not:
- Attack third-party systems
- Teach stealth, persistence, or evasion
- Represent production-grade SOC architecture
- Replace official Wazuh or Kubernetes documentation

Check your understanding

Use these questions to check whether the lab and analyst concepts are clear before moving forward.

  1. What is the difference between an event and an alert?
  2. Why is every alert not automatically an incident?
  3. What does a SIEM help with?
  4. What does XDR usually add conceptually?
  5. Why should a SOC lab have a written scope?
  6. Why should test events be safe and controlled?
  7. What is a finding?
  8. What is triage?
  9. Why is Kubernetes useful for this lab?
  10. What should this lab not be used for?
Answer key
  1. An event is something that happened; an alert is an event or pattern that a rule decided may matter.
  2. Some alerts are false positives, expected behavior, low severity, or lack impact.
  3. Centralizing, searching, correlating, and reviewing security telemetry.
  4. Broader cross-domain detection and response.
  5. It defines boundaries and prevents reckless or unclear activity.
  6. To teach investigation without causing harm.
  7. A documented observation requiring remediation, tuning, or follow-up.
  8. Deciding what an alert means and what action is appropriate.
  9. It provides repeatable workloads, namespaces, logs, services, and security boundaries.
  10. Attacking real systems, teaching evasion, or claiming production readiness.
← Previous: Kubernetes SOC Field Lab Series index Next: Kubernetes SOC Lab Architecture →