A curated collection of essential resources, tools, and references for Security Operations Center (SOC) analysts.
اللَّهُمَّ صَلِّ علَى مُحَمَّدٍ وعلَى آلِ مُحَمَّدٍ، كما صَلَّيْتَ علَى إبْرَاهِيمَ وعلَى آلِ إبْرَاهِيمَ؛ إنَّكَ حَمِيدٌ مَجِيدٌ.
اللَّهُمَّ بَارِكْ علَى مُحَمَّدٍ وعلَى آلِ مُحَمَّدٍ، كما بَارَكْتَ علَى إبْرَاهِيمَ وعلَى آلِ إبْرَاهِيمَ؛ إنَّكَ حَمِيدٌ مَجِيدٌ.
Pro Tip: Use
Ctrl+F/Cmd+Fto quickly find resources by keyword!
┌── Training Courses
├── Articles
├── Documents & Publications
├── Blogs
├── YouTube Playlists/Videos
├── Shuffle Automation
├── CyberSec Frameworks & Models / Risk Assessment
├── GitHub Repositories
├── Email Analysis
├── File Analysis
├── Cheat Sheets
├── Websites and Tools
├── Adversary Emulation Platform
├── Threat Hunting
├── DFIR
├── Hardening
├── Cyber Threat Intelligence
├── Cyber Threat Intelligence Platforms
├── MISP Resources Documentation
├── Kraven Security MISP Series
├── IoCs & Security Analysis & Threat Intelligence Tools
├── Vulnerability Intelligence Resources
├── Data Breach & Leak Monitoring Services
├── Privacy & Image Search Tools
├── Hacking Communities & Resources
├── Start.me pages
├── Reddit Communities
├── OSINT Communities
├── OSINT Medium Bloggers
├── OSINT Resources
├── Telegram Channels
└── Exams & Quizzes- DFIR Training
- CYBER 5W
- LetsDefend - SOC Analyst Learning Path
- CyberDefenders
- Pwned Labs
- HTB - SOC Analyst
- THM - SOC Level 1
- THM - SOC Level 2
- ACE Responder
- XINTRA
- Cyber Dojo
- 13Cubed
- SOCRadar
- Antisyphon Training
- NCSC - Exercise in a Box
- In-Depth Investigation & Threat Hunting
- Student SOC Program Foundations training
- Coursera - Security Operations Center (SOC)
- Web Security Academy
- CryptoHack
- OverTheWire
- thirdeyeintel - Navigating the Evolving Cyber Threat Landscape: Insights from ACSC’s 2021-2023 Reports
- thirdeyeintel - AI-Enhanced SOCs in 2025: Defenders, Co-Pilots, and the New Cyber Threat Frontier
- thirdeyeintel - My take on Role of Threat Intelligence in Security Operations
- thirdeyeintel - The Future-Ready SOC: A Blueprint for Maturity, Resilience, and Real-World Impact
- MITRE ATT&CK®
- Tuning Detections isn’t Hard Unless You Make it Hard
- Detect FYI - Becoming a Detection Engineering Contractor, Part I — The Motivation
- Detect FYI - Becoming a Detection Engineering Contractor, Part II— The Preparation
- Detect FYI - Threat Hunting (Suspicious Windows Services)
- Hackndo - Spray passwords, avoid lockouts
- Hackndo - NTLM Relay
- Hackndo - Kerberos Delegation
- Pulsedive - Collection through Correlation: Operationalizing IP and Domain Indicators of Compromise
- Pulsedive - Assemblyline 101 - Open Source Malware Triage
- Pulsedive - Phishing Kits 101 & V3B Phishing Kit
- Pulsedive - Tool Guide: CyberChef 101
- Loggly - Windows Logging Basics
- Loggly - Troubleshooting with Windows Logs
- Loggly - Centralizing Windows Logs
- CrowdStrike - AI SIEM
- SANS - Incident Response
- Splunk - Security Operation Center
- Splunk - Indicators of Compromise (IoCs): An Introductory Guide
- A Career Guide for Your First Analyst Role and Beyond
- Measuring Detection Coverage
- A Sysmon Event ID Breakdown
- Ransomware identification for the judicious analyst
- How SELinux deny rules improve system security
- Hack The Logs
- Event Log Compendium
- The Base-Rate Fallacy and its Implications for the Difficulty of Intrusion Detection
- Implementing SIEM and SOAR platforms: Executive guidance
- Best practices for event logging and threat detection
- Priority logs for SIEM ingestion: practitioner guidance
- Small business cyber security guide
- Windows event logging and forwarding
- Guide to Security Operations
- No-Budget Living-Off-the-Land Detection
- Engineering Everything with eBPF
- The Fundamental Guide to Building a Better SOC
- The State of Security 2023
- Splunk ES Correlation Searches Best Practices v1.3
- ohmymalware
- Awesome Threat Intel Blogs
- CrowdStrike Blog
- Detect FYI
- Nextron Systems
- FalconForce
- SpecterOps
- Red Canary
- Huntress
- Security Investigation
- The DFIR Report
- Know Your Adversary
- CyberTriage
- Huntress
- HackForLab
- Cyberdefense
- Hadess
- eCrime
- DevSecOps Guides
- Exploit Reversing
- InfoStealers
- Hackers Arise
- David Varghese
- Ogmini
- What is a SIEM
- SOC Videos
- SOC100 Full Playlist
- I Want to Be a SOC Analyst, What Do I Do?
- Malware Traffic Analysis with Wireshark
- Wireshark Masterclass
- PowerSIEM - Analyzing Sysmon Events with PowerShell - Dynamic Malware Analysis
- Advanced Windows Logging - Finding What AV Missed
- Malicious Document Analysis
- Understanding Runtime Linking in Windows: A Deep Dive for Reverse Engineers and Malware Analysts
- Malware Analysis
- Incident Response Training
- Digital Forensics
- Cyber Threat Intelligence
- Cyber Threat Intelligence Summit 2024
- Threat Hunt Training
- Threat Hunting & Incident Response Summit 2021
- Blue Teaming and Network Defense Series
- VirusTotal Academy - SOC & IR
- ISO 27001
- PCI DSS
- Malware Theory on Blackboard
- SOC Analyst Training
- Introducing Shuffle — an Open Source SOAR platform part 1
- Getting started with Shuffle — an Open Source SOAR platform part 2
- Integrating Shuffle with Virustotal and TheHive — Open Source SOAR part 3
- Real-time executions and IoC’s with Shuffle, TheHive and MISP — Open Source SOAR part 4
- Cyber Kill Chain
- MITRE ATT&CK
- ISACA
- NIST
- NIST Risk Assessment Template
- PCI DSS
- ISO
- HIPPA
- ASTP
- COBIT
- CSA
- CIS Benchmarks
- SCF
- SOC2
- FAIR
- IACS
- ISA
- CESG
- SOC Analyst Notes
- SOC-RESSOURCES
- Detection Engineering Starter Pack
- OSINT Dashboard
- Cybersecurity Resources and Learning Journey
- Splunk
- Awesome SOC Analyst
- Awesome SOC
- Blue Team Notes
- Incident Response Playbooks Mapped to MITRE Attack Tactics and Techniques
- Playbooks for SOC Analysts
- MISP Playbooks
- How to Get Email Headers
- Email Header Analyzer
- E-Mail Header Analyzer
- DMARC tester
- Learn and Test DMARC
- Free email address verification tool
- RFC Editor
- SG TCP/IP Ports database
- FileInfo
- ASCII Code Table
- File Signatures Database
- Syscall Tables
- EDR Telemetry Resources
- Antivirus Event Analysis Cheat Sheet
- Cheat Sheets to help you in configuring your systems
- TCP/IP and tcpdump Pocket Reference Guide
- Windows Security Log Events
- Digital Forensics and Incident Response
- Detections AI
- SOC Resources for Daily Operations
- Suricata
- Snort
- Wireshark
- YARA
- Zeek
- Ubertooth
- Tcpdump
- PCAPdroid
- Sniffnet
- Sniffglue
- Ngrep
- Kismet
- KisMAC
- Ettercap
- Driftnet
- Arkime
- Attack Rule Map
- endoflife.date
- MITRE ATT&CK
- MITRE ATT&CK Groups
- Threathunting Frameworks
- Threat Hunt Book by Predefender
- Threat Hunting Maturity Model Explained With Examples
- eXtended Threat-informed Defence (XTID)
- AttackRuleMap
- Threat Hunting Keywords
- Non-Human Identity Threat Center
- DNS Abuse Techniques Matrix
- Detection Engineering Maturity Matrix
- Evids
- Majestic Million Websites
- AboutDFIR
- DFUR Diva
- Digital Forensics Guide
- Forensic Focus
- Digital Forensics and Incident Response
- Awesome Incident Response
- Incident-Playbook
- RegSeek
- Timestamp Solver
- Epoch Converter
- Qu1cksc0pe
- Detect-It-Easy
- malwoverview
- DFIRTrack
- Aurora Incident Response
- FJTA - Forensic Journal Timeline Analyzer
- Unix-like Artifacts Collector (UAC)
- UEFITool
- DFIR_Toolbar
- TheHive
- Fast Incident Response
- GRR Rapid Response
- DFIR IRIS
- C2-Tracker
- ID Ransomware
- No more Ransom
- forensictools
- Living Off the Living Off the Land
- UnProtect
- EchoTrail
- TrailDiscover
- BLADE Framework Matrix
- ARTToolkit
- Exploit Notes
- CyberChef
- URL2PNG - Website Screenshot Service
- Getting Started with ISO 27001
- CIS Benchmarks
- How To Secure A Linux Server
- The Practical Linux Hardening Guide
- OpenSCAP
- DevSec Project
- HARDN-XDR
- Hardening Ubuntu. Systemd edition.
- lynis
- CrowdStrike - Cyber Threat Intelligence Explained
- CrowdStrike - Attack Vectors
- CrowdStrike - Threat Actors Explained
- CrowdStrike - What is an Attack Surface?
- Integrating Large Language Models with Knowledge Graphs for Cyber Threat Intelligence Credibility Assessment
- Awesome Threat Intelligence
- Best Practices for MITRE ATT&CK® Mapping
- Cheatsheet: Threat Attribution in Threat Intelligence
- CTI-CMM
- Orange Cyberdefense
- Hacktivist Coalitions
- Adversaries
- Threat Intel Bot
- deepdarkCTI
- MISP Galaxy & MISP Taxonomies
- Global Threat Landscape Reports
- IntelMQ
- MISP
- Open-CTI
- AlienVault
- IntelOwl
- Build Your Own Cyber Threat Intelligence Program
- Building a Cyber Threat Intelligence Platform in 5 steps
- MISP Categories and Types
- MISP Project Tools
- Using the MISP System
- Attributes REST API
- Threat Intelligence Best Practices
- MISP to Splunk Integration (PDF)
- MISP Instance Sizing
- MISP Deployment Training (PDF)
- Feed Metadata Defaults (JSON)
- MISP Threat Intel
- Part 1: What is MISP?
- Part 2: Setup Guide
- Part 3: Creating Events
- Part 4: Using Feeds
- Part 5: Searching & Filtering
- Part 6: API Usage
- Part 7: Exporting IOCs
- VirusTotal File Scan
- Hybrid Analysis
- ANY.RUN Interactive Malware Analysis
- SOCRadar
- threatYeti
- MetaDefender
- Joe Sandbox
- FileScan.io
- URLScan.io
- PhishTank
- OpenPhish
- Phishing Database
- AbuseIPDB
- VirusShare
- abuse.ch
- URLVoid
- IP Void
- Palo Alto URL Filter
- Symantec Filter
- Symantec IP Reputation Investigation
- Trend Micro IP Reputation Lookup
- IP Address Lookup
- Kaspersky Threat Intelligence
- IOC.one
- FireHOL IP Lists
- ThreatFeeds.io
- WannaBrowser
- Browserling
- Cisco Talos Intelligence
- Pulsedive Threat Intelligence
- MyWot
- GreyNoise Visualization
- BrightCloud URL/IP Lookup
- IBM X-Force Exchange
- Spamhaus Lookup
- InQuest Deep File Inspection
- CrowdSec CTI
- Threat Zone URL Analysis
- CRXplorer
- IsLegitSite
- HaveIBeenSquatted
- Spydi's ThreatIntel Feed
- Free Threat Intel/IOC Feeds
- ThreatMon's Daily Command and Control (C2) Feed
- Sophos-originated indicators-of-compromise from published reports
- Indicators from Unit 42 Public Reports
- openhunting
- Free and Open Source Threat Intelligence Feeds
- CVSS v4.0
- FIRST CVSS Version 4.0 Calculator
- NVD CVSS Calculator
- DBugs
- OWASP Risk Assessment Calculator
- Common Weakness Enumeration
- CISA Known Exploited Vulnerabilities
- Bleeping Computer
- Cybersecurity News
- Vulert
- Vulners
- SecurityVulnerability.io
- VulDB Vendor Search
- National Vulnerability Database
- CVE MITRE Database
- Vulnerability Explorer
- VDE
- CVE Monitor
- Mend.io Vulnerability Database
- Vulmon Vulnerability Trends
- CVE Details
- CERT Vulnerability Notes Database
- MS Security Update Guide
- Exploit Kitploit
- Exploit Database
- SPLOITUS
- CVSS-BT
- PoC in GitHub
- CVE to EPSS Converter
- EPSS API
- Vulnerability Lookup
- Wiz Vulnerability Database
- Threat Search
- VulnCheck KEV
- Have I Been Pwned
- Am I Breached
- Firefox Monitor
- LeakPeek
- Distributed Denial of Secrets
- WikiLeaks
- Cyber Leaks
- Scattered Secrets
- DeHashed
- BreachDirectory
- HackCheck
- IntelligenceX
- IDStrong
- Identity Guard Scan
- ImmuniWeb Dark Web Scan
- Leak-Lookup
- Snusbase
- LeakCheck
- LeakRadar
- The Ultimate Osint Collection
- Cyber Threat Intelligence
- build-a-soc
- CTI
- infosec
- Forensics
- OSINT Darkweb Russia
- Dark Web
- The Ultimate OSINT Collection
- OSINT4ALL
- Main Tools
- OSINT Tools & Resources
- OSINT Research Portal
- SOCMINT Toolkit
- Privacy & Security
- Search Engines
- Social Media Search
- V3nari Bookmarks
- Digital Forensics
- Deepfake Detection
- IT & Cybersecurity
- Mobile
- Toolkit
- AML Toolbox
- Nixintel's OSINT Resource List
- Hunt OSINT
- OSINT Smart Framework
- AsINT Collection
- OPSEC Online Privacy
- AtoZosint
- Open Sourcery
- Cyber
- Threat Hunting
- OSINT Global Non-US
- Network System Administration
- Terror Finance and Arms Division
- Cybersecurity CTFS Tools
- Terrorism Financing
- Sussex Global Analysis
- Tracing Arms Identifying Combatants
- Online Extremism Terrorism
- Learning Resources
- Latest News Articles Reports
- Triage Investigations IR
- Datasets & Databases
- Terrorism Radicalisation Research Dashboard
- CTF
- Pen Testing / Red Team
- DFIR Jedi
- Business Resilience
- Malware Analysis
- Threat Informed Defense Ecosystem
- International Security Research
- OSINT Tools Miscellaneous
- Human Resources Counter Intelligence
- Cybersecurity101
- netsec
- AskNetsec
- SecurityCareerAdvice
- ITCareerQuestions
- netsecstudents
- blueteamsec
- redteamsec
- securityCTF
- ReverseEngineering
- computerforensics
- crypto
- webscraping
- privacy
- PrivacyGuides
- privacytoolsIO
- tryhackme
- hackthebox
- Splunk
- CryptoCurrency
- sysadmin
- hardware
- technology
- programming
- learnprogramming
- UK OSINT
- Best OSINT communities
- OSINT UK
- OSINT France
- OSINT Nord
- OSINT Switzerland
- Osmosis Institute
- Cyber Social Hub
- OSINT Team
- Projet Fox
- Techjournalist
- Igor S. Bederov
- CyberGuy
- Oloyede Olajumoke Elizabeth
- Chad Warner
- IntelTakes
- Steve Micallef
- Tokyo_v2
- Tom Jarvis
- Somdev Sangwan
- Jeffrey Mader
- Benjamin Strick
- @DFRLab
- Officer's Notes
- Christina Lekati
- InfoSecSherpa (Tracy Z. Maleeff)
- wondersmith_rae
- Intel_Inquirer
- Best OSINT books
- Awesome OSINT Repository
- Social Media OSINT Tools Collection
- Social Media OSINT
- Awesome OSINT For Everything
- BBOT
- OSINT Cheat Sheet