🛡️ SOC Learning Journal

A hands-on Blue Team portfolio documenting real cybersecurity investigations using Wireshark, Linux, Nmap, and enterprise networking labs.

🎯 Objective

This repository showcases practical SOC Analyst skills built through hands-on investigations rather than theory. Every project contains packet captures, Linux commands, evidence, screenshots, methodology, and findings.

---

📂 Completed Investigations

#	Investigation	Status
01	SSH Brute Force Investigation	✅
02	ARP Spoofing (MITM) Investigation	✅
03	DNS Traffic Analysis	✅
04	DNS Tunnelling Detection	✅
05	HTTP vs HTTPS Investigation	✅
06	TLS Handshake Analysis	✅
07	DHCP Investigation (DORA Process)	✅
08	Nmap Reconnaissance Detection	✅

---

🛠️ Skills Demonstrated

Network Security

• Packet Analysis
• TCP/IP
• DNS
• DHCP
• ARP
• HTTP / HTTPS
• TLS

SOC Investigation

• Network Reconnaissance Detection
• Credential Exposure Analysis
• MITM Traffic Analysis
• DNS Tunnelling Detection
• Wireshark Investigation Methodology

Linux & Security Tools

• Wireshark
• Nmap
• tcpdump
• Apache2
• OpenSSL
• Linux Terminal

---

🖥️ Lab Environment

Machine	Purpose
Kali Linux	Attacker / SOC Analyst
Ubuntu	Victim Workstation
Wireshark	Packet Capture & Analysis
VirtualBox	Isolated Lab Environment

---

📈 Learning Roadmap

• Networking & Packet Analysis
• 8 SOC Investigations
• Linux for SOC
• Splunk SIEM
• CompTIA Security+
• TryHackMe SOC Level 1

---

📌 Repository Purpose

This journal represents my transition from Enterprise IT into Blue Team Cybersecurity by documenting real investigations, analytical thinking, and practical defensive skills.

Every packet tells a story. Every investigation builds a better defender.