#006 | Alert Reporting — All Answers + SOC Simulator Lab | TryHackMe SOC Level 1

Description In this video we go straight to the answers. Every question in the TryHackMe SOC L1 Alert Reporting room, plus the complete SOC Simulator practical — investigating both alerts, writing the reports and escalating them to L2. No theory sections. If you want the full explanation of reporting, escalation and communication, watch the complete walkthrough: ▶ Full walkthrough — SOC L1 Alert Reporting Explained:    • #006 | Alert Reporting Explained | TryHack...   ▶ Previous room — SOC L1 Alert Triage:    • #005 | Alert Triage Explained | TryHackMe ...   What you will see: • Every room question answered, in order • Alert 1 — the phishing email, investigated end to end • Reading the email headers and spotting the SPF and DKIM failures • Writing a full analyst comment using the five W's — who, what, when, where, why • Alert 2 — a spike of whoami, net user and Get-ADUser commands • Researching w3wp.exe and mapping the behaviour to MITRE ATT&CK • Setting the verdict, assigning to L2 and escalating correctly • Both flags ⏱ Chapters 0:00 Intro 1:46 Q — Which user email leaked the sensitive document? 2:01 Q — Who sent the suspicious phishing email? 3:08 Opening and reading the phishing alert 4:22 Alert details — subject, body and sender 5:28 Checking SPF and DKIM in the header 6:34 Writing the report with the five W's 9:52 Saving the report and the first flag 10:21 Q — Who is your current L2? 10:43 Q — What flag after escalating the alert? 11:56 Alert 2 — a spike of domain discovery commands 14:24 Researching w3wp.exe on MITRE ATT&CK 15:36 Back to the alert — weighing the evidence 16:15 Editing the alert — assign, in progress, verdict 17:12 Writing the alert 2 comment 20:38 Escalating to L2 and the second flag 21:17 Q — Crisis communication answers 21:49 Room completed This is part of our TryHackMe SOC Level 1 walkthrough series, where we work through the SOC Level 1 learning path step by step and explain the concepts along the way. Topics: SOC Analyst, SOC L1, Alert Reporting, Alert Escalation, SOC Simulator, TryHackMe Answers, Security Alerts, SIEM, Incident Detection, Incident Response, Cybersecurity, SOC Operations, True Positive, Alert Investigation, Five Ws, LummaStealer, Phishing, SPF, DKIM, MITRE ATT&CK #TryHackMe #SOC #CyberSecurity #SOCAnalyst #AlertReporting #SOCSimulator #SIEM #SOCLevel1 #BlueTeam #Walkthrough Tags #soc l1 alert reporting answers, #tryhackme #alert reporting answers, #soc simulator walkthrough, #tryhackme soc level 1, #soc level 1 walkthrough, #alert reporting, alert escalation, soc analyst, soc l1, tryhackme answers, soc simulator, siem, incident response, phishing investigation, #spf dkim fail, five ws report, #mitre attack, w3wp exe, domain discovery, #get-aduser, #whoami, true positive, alert triage, blue team, cybersecurity walkthrough, soc operations, learnit