Video summary

A Real Day in Life of a SOC Analyst | Remote Work from Home Reality

Main summary

Key takeaways

Technology

Summary of the subtitles (SOC Analyst / Remote SOC work reality)

Morning workflow (triage + monitoring)

  • Starts the day by checking urgent emails and reviewing the day’s calendar/meetings.
  • Uses a monitoring dashboard that shows phishing reports generated while offline.

Email phishing investigation (automation + manual validation)

  • The email monitoring/processing platform is Phantom by Splunk.
  • Automations ingest and process emails so much of the work is already handled (about 90% of the heavy lifting).
  • Analysts still need to investigate most reports because phishing reports from across the company are funneled into one destination.
  • For phishing analysis, analysts check:
    • Automation outputs/detections
    • The actual received email by opening the EML file
    • Common indicators such as urgency, subject wording, email body/sentences, domain, and overall context
  • Response action:
    • If confirmed malicious, the process blocks sender and recipient via another automated step.
  • Volume note:
    • Roughly 10–20 reports per day, with many false positives—but investigating is safer.

Endpoint detection workflow (CrowdStrike Falcon)

  • Checks endpoint detections across laptops, phones, and servers.
  • Uses CrowdStrike Falcon, which is cloud-based and deployable remotely.
  • For each alert:
    • Reviews alert details, including the application/activity that triggered it
    • Determines whether it’s a true positive by researching and scheduling a call with the user for context
  • Support model:
    • Contract includes 24/7 support, so severe alerts don’t require analyst on-call.
    • Caveat: vendor support investigates only medium to high severity; analysts still handle lower severity items.

Cloud vulnerability monitoring (AWS security services)

  • Most cloud monitoring work happens in AWS.
  • Two key services:
    1. GuardDuty
      • Detects network-related threats, including:
        • Brute force attempts from malicious IPs
        • Port probing
        • Suspicious credential usage
      • Example workflow:
        • Look up an IP’s reputation/occurrence frequency
        • If confirmed malicious, block it via firewall
    2. Trusted Advisor
      • Provides recommendations for AWS account weaknesses that need fixing
      • Example:
        • An IAM user requires access key rotation after exceeding a day threshold

Development / tooling (Splunk dashboard building)

  • After triage work, some time goes to development.
  • Builds a Splunk dashboard using SPL (Search Processing Language), described as similar to SQL.
  • Example development focus: getting an overall view of the firewall.

Meetings / time impact

  • Standups happen in the morning; total meetings are about ~1 hour/day.
  • Contrast: management can spend up to ~75% of the day in meetings.

Productivity + remote work analysis (pros/cons)

  • Working from home is believed to improve productivity by reducing distractions (fewer small chats and interruptions).
  • Some days run longer hours, but having an office nearby helps incident response without long “getting home” delays.
  • Major benefits:
    • Avoiding traffic
    • Saving money on food and travel
  • Company return-to-office pressure:
    • Company aims for ~3 days/week in office
    • Department survey: most prefer remote or in-office only ~once/week
    • Speaker personally goes in about once every two weeks, with the team coordinating a specific day for catch-ups
  • Conclusion:
    • Remote effectiveness depends on the occupation, but for this SOC role it’s beneficial because it supports concentration.

Main speakers / sources

  • Main speaker: The video narrator (a Cyber Security / SOC Analyst, working remotely).
  • Products/services mentioned as key sources of functionality:
    • Splunk Phantom
    • CrowdStrike Falcon
    • AWS GuardDuty
    • AWS Trusted Advisor
    • Splunk (SPL / dashboards)

Original video