Tools & Technologies
Common SOC tools, what they’re used for, and practical use cases.
Showing 10 of 10
TOOL-01
How would you use Wireshark in a SOC investigation?
▾
TOOL-01
How would you use Wireshark in a SOC investigation?
Answer: To inspect packet captures, follow streams, identify protocols, confirm beaconing, and validate suspicious connections.
Tip: Mention filters (ip.addr, tcp.port, dns) and focusing on context, not just payload.
TOOL-02
What is Nmap used for and what would you look for?
▾
TOOL-02
What is Nmap used for and what would you look for?
Answer: Port scanning and service discovery. In SOC, unexpected scans can indicate recon or lateral movement.
Tip: Know that internal scanning can be legit—validate source and change ticket.
TOOL-03
What is Burp Suite (high level)?
▾
TOOL-03
What is Burp Suite (high level)?
Answer: A web security testing proxy used to intercept and analyze HTTP(S) traffic; common in appsec/pentesting.
Tip: SOC tie-in: suspicious proxy tools on endpoints can be a signal.
TOOL-04
What is the ELK stack?
▾
TOOL-04
What is the ELK stack?
Answer: Elasticsearch (search/index), Logstash (ingest/parse), Kibana (visualization). Often used for log analytics/SIEM-like workflows.
Tip: Mention parsing/normalization and dashboards.
TOOL-05
Splunk vs ELK—what’s the difference in general?
▾
TOOL-05
Splunk vs ELK—what’s the difference in general?
Answer: Splunk is a commercial platform with integrated features; ELK is open-source components you operate and tune. Both can ingest and query logs.
Tip: Don’t bash either—focus on what you can do: search, dashboards, detections.
TOOL-06
What are Sysinternals tools and why are they useful?
▾
TOOL-06
What are Sysinternals tools and why are they useful?
Answer: A suite for deep Windows diagnostics (Process Explorer, Autoruns, Sysmon, etc.). Great for triage and persistence hunting.
Tip: Autoruns is a strong mention for persistence checks.
TOOL-07
What is a sandbox and why do we use it?
▾
TOOL-07
What is a sandbox and why do we use it?
Answer: An isolated environment to detonate suspicious files/URLs and observe behavior safely.
Tip: You still validate results—sandbox output isn’t always definitive.
TOOL-08
What is threat intelligence and how do you use it?
▾
TOOL-08
What is threat intelligence and how do you use it?
Answer: Curated information about threats (IOCs, TTPs, actors). Used to enrich alerts, block bad indicators, and guide hunting.
Tip: Show balance: TI supports decisions but doesn’t replace local evidence.
TOOL-09
How can SOAR help a SOC?
▾
TOOL-09
How can SOAR help a SOC?
Answer: SOAR automates repetitive workflows (enrichment, ticketing, quarantining) and standardizes playbooks.
Tip: Mention reducing response time and improving consistency.
TOOL-10
What’s your approach to automating SOC work safely?
▾
TOOL-10
What’s your approach to automating SOC work safely?
Answer: Start with low-risk tasks (enrichment, tagging), add approvals for disruptive actions, test in staging, and monitor outcomes/rollbacks.
Tip: Automation should reduce toil, not create outages.