What A Security Analyst Does On A Daily Basis by Elizabeth Momola

### Overview Elizabeth Momola, a security analyst at Quorum Cyber and graduate apprentice at Edinburgh Napier University, presents a detailed walkthrough of what a Security Operations Center (SOC) analyst does daily. Momola demystifies the role, outlines standard industry terminology, demonstrates threat analysis using Microsoft Sentinel and Kusto Query Language (KQL), and shares practical career advice for newcomers.

### Key Topics - **Role of a Security Analyst**: Job expectations vary significantly across employers, ranging from basic ticket triaging to incident response, firewall configuration, vulnerability scanning, and security recommendations. Job titles also lack industry-wide consistency. - **Core Terminology & Concepts**: Essential industry concepts include MSSP (Managed Security Service Provider), SOC (defensive/blue team), Incident Response, SIEM, SOAR, EDR, UEBA, IDS/IPS, and SLAs for prioritizing workloads. - **Microsoft Sentinel Architecture**: A cloud-native SIEM and SOAR platform that ingests logs from diverse environments (AWS, on-premises, firewalls, IIS, SQL) into Log Analytics tables. Features include alert rule templates, incident management, investigation graph views, entity mapping, and automated playbooks (e.g., Teams alerts, IP/user blocking). - **Kusto Query Language (KQL)**: A read-only query language used to retrieve and correlate logs across Log Analytics tables without altering stored log data. Used for detection rules, investigations, troubleshooting, and threat hunting (such as Log4j detection).

### Technical Details - **KQL Querying in Practice**: - Initial environment reconnaissance: `search * | summarize count() by $table` identifies available tables across the workspace (e.g., 57 tables in the demo environment). - Targeted discovery: Searching for a specific IP string across tables identifies hits in tables such as `VMConnection` and Azure diagnostic tables. - Schema inspection: Using `limit 10` returns sample rows to review column headers like `TimeGenerated`, `Computer`, `ProcessName`, `SourceIp`, `DestinationPort`, and protocol. - Data filtering & projection: Filtering on `where RemoteIp has "<ip>"` and selecting specific fields via `project` highlights inbound HTTP traffic (port 80) directed toward internal retail systems. - **External Threat Intelligence Correlation**: - Analysts must verify external intelligence rather than assuming an IP is malicious, as shared web hosting and IPv4 limitations cause benign domains to share IPs with previously malicious infrastructure. - Demonstration tools: ThreatCrowd (community voting and domain mapping), Cisco Talos (network owner, reputation, traffic volume anomalies, blocklist checks), and AbuseIPDB (ISP details, category reports showing active port-scanning behavior). - Case Study: Momola recounts an alert for command-and-control (C2) activity in Microsoft Defender that appeared suspicious but ultimately traced back to an employee in New York legitimately browsing a local bagel shop whose website shared an IP with previously flagged infrastructure.

### Takeaways - **Analyst Mindset Over Specific Tools**: While SIEM platforms differ across organizations (e.g., Sentinel vs. Splunk), the fundamental competencies are investigative reasoning, understanding network traffic flow, and knowing how to ask the right questions. - **Automation Caution & Collaboration**: Automated response rules and alert closures must be carefully vetted by broader teams to avoid whitelisting malicious activity or generating disruptive false positives. - **Log Retention & Cost Constraints**: Default retention is often three months; ingesting high-volume sources like firewalls requires pre-filtering due to cost constraints, though under-collection often hinders breach investigations. - **Career Navigation**: A SOC position provides a strong foundation for lateral moves into incident response, pen testing, or security engineering. Career pivots are viable at any stage, and practical enthusiasm (e.g., CTFs, TryHackMe, direct networking) helps early-career applicants stand out.