Cybersecurity
SOC Analyst Level 1 with Splunk
Learn the work of a first-line SOC analyst: triage alerts, search logs in Splunk, read Windows events and analyse phishing.
SOC Analyst Level 1 with Splunk is a free, self-paced online course from EDWartens for aspiring SOC analysts, IT support staff and security students. It has 9 modules and takes about 7.7 hours, with written notes, a practice task per module, a practical project and a final assessment of 15 questions (pass mark 60%). Learning costs nothing and needs only a free account. The optional EDWartens Certificate of Completion, verifiable by code, is a one-off US$23.99 for you; it is not a vendor credential. Updated 1 November 2026.
- Free
- Beginner
- 7.7 hours
- Self-paced
- Certificate optional
- Lab practice in your browser
No card, no trial. The course is free for good. Certificate US$23.99, optional.
- Who it is for
- Aspiring SOC analysts, IT support staff and security students
- Jobs
- Roles that use this skill: OT security analyst, security engineer, network engineer and compliance analyst. No course guarantees a job.
- Tools
- Splunk Enterprise (the free 60-day trial, which can convert to the free licence), the public Boss of the SOC v1 dataset, Wireshark, and a Windows virtual machine for Event Viewer. All free. Hardware: A laptop or desktop with 16 GB of RAM is comfortable for Splunk and a Windows VM together; 8 GB works if you run them one at a time.
- Updated
After this course you can
By the end you will be able to:
- Follow the incident response process from triage to lessons learned
- Read Windows logon and process events and spot an attack sequence
- Write SPL searches that count, filter and chart
- Analyse a phishing email from its headers, links and attachments
- Map an incident to MITRE ATT&CK and check indicators
Who it is for, and what you need first
Who it is for
Aspiring SOC analysts, IT support staff and security students.
Level: Beginner. Beginner, with the basics in place. You should know what an IP address, a port and the CIA triad are; Cybersecurity Fundamentals covers them if not.
What you need
Software: Splunk Enterprise (the free 60-day trial, which can convert to the free licence), the public Boss of the SOC v1 dataset, Wireshark, and a Windows virtual machine for Event Viewer. All free..
Hardware: A laptop or desktop with 16 GB of RAM is comfortable for Splunk and a Windows VM together; 8 GB works if you run them one at a time.. What to download, and how.
How this course works
Watch the lessons
Short video lessons, one module at a time, at your own pace.
Read the notes
Open the Reading tab for the written notes and diagrams of the module.
Practise in the 3D labOptional
Try the module in the free 3D lab, in your browser.
Check yourself
Answer the questions to see what stuck before you move on.
Final assessment
Pass the final once you have been through the modules.
Certificate, if you want oneOptional
Optional, with a page anyone can use to verify it.
What you learn
9 modules in order, at your own pace. 7.7 hours of video lessons, with written notes and a practice task in each module.
- 1What a SOC analyst actually does20m
- 2The incident response process, with lab practice: 31m
- 3Windows event logs every analyst must read, with lab practice: 29m
- 4Splunk search basics and SPL36m
- 5Hunting in Splunk: Boss of the SOC1h 5m
- 6Network traffic with Wireshark39m
- 7Phishing email analysis32m
- 8MITRE ATT&CK and threat intelligence29m
Show the other 1 modules
- 9Final Assessment6m
Software you need
What to download, where from, what it costs and how to install it. Every link goes to the maker's own site, never a mirror.
The Windows virtual machine is for the Event Viewer exercises.
Show what to download (5 tools)
Required
- 01Free trial: 60 days, then a free licence
Splunk Enterprise
Splunk (a Cisco company)
- Runs on
- Windows 10 and Windows Server 2019, 2022, 2025; Linux (kernel 4.x, 5.x, 6.x; .rpm, .deb, .tgz); macOS on Apple silicon
- Account
- A free splunk.com account
The Enterprise trial lasts 60 days and indexes up to 500 MB a day, with no credit card. You can then switch to Splunk Free, which keeps 500 MB a day with no time limit but has no alerting, no user logins and no clustering.
Steps
- 1.Open the Splunk Enterprise download page and sign in or create a free splunk.com account.
- 2.Choose your operating system and download the installer.
- 3.Run the installer and create the administrator user name and password it asks for.
- 4.Open Splunk Web in your browser from the link the installer shows and sign in.
- 5.Before the 60 days end, go to Settings, then Licensing, and change the licence group to Free.
- Stay under 500 MB of new data a day. Three warnings in 30 days disable search on the Free licence.
- When you switch to Free, alerts stop and user accounts no longer work, so do it at the start of a new lab rather than mid-way.
Official download pagesplunk.com - 02Free
Boss of the SOC (BOTS) Dataset Version 1
Splunk
- Runs on
- Any system that runs Splunk Enterprise
- Account
- None needed
- Size
- About 6.1 GB compressed (Splunk pre-indexed); about 135 MB for the attack-only version
The dataset is released to the public domain under CC0, so you can use it freely. Splunk and the add-ons it needs are licensed separately.
Steps
- 1.Install Splunk Enterprise (the free trial, or the Free licence) first.
- 2.Open github.com/splunk/botsv1 and download botsv1_data_set.tgz (or the smaller botsv1-attack-only.tgz).
- 3.Extract it into the etc/apps folder of your Splunk installation.
- 4.Install the add-ons listed in the README from Splunkbase, such as the Fortinet, Windows, Sysmon, Suricata and Stream add-ons.
- 5.Restart Splunk and search: index=botsv1 earliest=0
- The full dataset needs a lot of disk space. Start with the attack-only version if space is short.
- The data comes from real or realistic incidents and may contain offensive language.
Official download pagegithub.com - 03Free
Wireshark
Wireshark Foundation
- Runs on
- Windows 11 or 10 64-bit (x64 or Arm64), Windows Server 2016 or later, macOS (Universal disk image), Linux
- Account
- None needed
Free, open source software. No licence fee for any use.
Steps
- 1.Open wireshark.org/download.html.
- 2.Download the Windows x64 Installer (or Arm64, or the macOS Universal Disk Image).
- 3.Run the installer and keep the Npcap option ticked on Windows.
- 4.Open Wireshark, pick your network interface and click the blue fin to start capturing.
- Npcap is needed for live capture on Windows. The Windows installer includes it.
- Only capture traffic on networks you own or have written permission to monitor.
Official download pagewireshark.org - 04Free
Oracle VirtualBox
Oracle
- Runs on
- Windows, macOS (Intel and Apple Silicon), Linux and Solaris hosts
- Account
- None needed
The VirtualBox platform packages are free and open source under GPL version 3. The separate Extension Pack is free only for personal and educational use (PUEL licence); business use of the Extension Pack needs a commercial licence from Oracle.
Steps
- 1.Open virtualbox.org/wiki/Downloads.
- 2.Click the package for your host system (for example, Windows hosts).
- 3.Run the installer and accept the network driver prompts.
- 4.Open VirtualBox, click New, choose your ISO file (for example Ubuntu or Windows) and follow the wizard.
- Turn on hardware virtualisation (Intel VT-x or AMD-V) in your PC's BIOS or UEFI if VirtualBox says it is not available.
- You do not need the Extension Pack for normal lab work. Install it only if you need its extra features and your use is personal or educational.
Official download pagevirtualbox.org - 05Free trial: 90 days
Windows 11 Enterprise (evaluation)
Microsoft
- Runs on
- Installs as a virtual machine or on a PC; ISO for x64 and Arm64
- Account
- A short registration form on the Microsoft Evaluation Center
A full-featured 90-day evaluation for testing, with no product key needed. When it expires the desktop turns black, a notice stays on screen and the PC shuts down every hour.
Steps
- 1.Open the Windows 11 Enterprise page on the Microsoft Evaluation Center.
- 2.Fill in the registration form and choose the ISO for your language and architecture (x64 for most PCs).
- 3.Create a new virtual machine in VirtualBox or Hyper-V and attach the ISO.
- 4.Install Windows 11 Enterprise and finish setup.
- 5.Take a snapshot of the fresh install so you can return to it after each lab.
- Windows 11 checks for TPM 2.0 and Secure Boot, so enable these in your virtual machine settings.
- Plan labs to finish within 90 days, or rebuild the VM from the ISO.
Official download pagemicrosoft.com
Checked against each maker's own page on 27 September 2026. Trial lengths and editions change; the maker's page is the final word.
Practise in the 3D lab
Practise the judgement of a SOC shift in the OT security lab: telling normal from suspicious in a day's logs, and running a response in the right order. Splunk itself is not part of the lab.
- Spot the intruder: the events that matter in a day's logOT security labOpen in the lab (opens in a new tab): Spot the intruder: the events that matter in a day's log
- Incident drill: a simulated note on an operator screenOT security labOpen in the lab (opens in a new tab): Incident drill: a simulated note on an operator screen
Optional. Skip it whenever you like: it never blocks your progress or your certificate.
Course project, about 10 hours
Level 1 investigation of an overnight RDP intrusion at a lender: triage playbook, IOC register, incident report and gap register
Investigate an overnight alert as a Level 1 SOC analyst at a lending company that runs Splunk. Triage the brute-force alert, trace what the attacker did from the Windows events, record the indicators and map the incident to MITRE ATT&CK. Write it up so Tier 2 and management can act. The sample pack shows each document filled in for a consumer lender.
- 4documents in the pack
- 5steps to follow
- 5things to hand in
- 10 hof work, at your pace
- ProcedureTriage playbook: failed-logon spike and brute force
- RegisterIndicator register: JUMP01 intrusion
- ReportIncident report: RDP intrusion on JUMP01
- Risk registerDetection gap register after the JUMP01 incident
The project is optional practice. The certificate needs only the modules and the final assessment.
After the course, your next step
Show what you can do, then keep going in the same field.
A certificate you can verify
Finish the modules and pass the final assessment (15 questions, pass mark 60%) and you can add a certificate with a public verification page. One-off, US$23.99 for you. It is not a vendor credential.
Want a free certificate? Do the matching Free internship: 4 weeks, nothing to buy, with a free certificate of completion.
Cybersecurity (IT and OT)
Eight short weeks of security basics, networks, access control, a security operations centre, industrial (OT) security, IEC 62443 and incident response: notes, diagrams, a few videos and worked exercises. Finish weeks 1 to 4 and the final, then claim a free Internship Completion Certificate with your real dates and study hours, and a QR code anyone can scan to verify it. Training, not employment.
See the internshipMore free courses
Roles that use this skill
- OT security analyst
- Security engineer
- Network engineer
- Compliance analyst
These are the kinds of roles where the skill is used. We make no promise of a job or an interview.
Plain notes
- Free: the whole course, the notes, the practice tasks, the final assessment and support from practising engineers.
- Paid, and optional: the course certificate, and the Engineer-verified internship (the Free internship costs nothing).
- No job promise: the course teaches a skill. It does not place you in a job.
- Lessons by: MyDFIR, ZeroDayVault (Cyber Panchayat), Cyber Shield, CyberPlatter. Independent creators; the lessons stream from their own channels. EDWartens wrote the study plan, notes, practice tasks and assessments.
MyDFIR · ZeroDayVault (Cyber Panchayat) · Cyber Shield · CyberPlatter · Hoplite Security · IBM Technology · Infosec Wizard · Jon Good · Micahs0day · Mike Chapple · Mohd Maaz · Simply Cyber (Gerald Auger) · Splunk How-To · SplunkGuru · Tech with Jono · iMentor · The MITRE Corporation. If you are one of these creators and want a lesson removed or credited differently, write to info@edwartens.com.
Practise what you learn in the free 3D lab
Technical work is judged on what you can do: wiring, commissioning, finding a fault. Doing a task yourself teaches more than watching it a second time, and a lab lets you try it safely before you meet real equipment. It does not replace working on real hardware.
- Practise safely, so a mistake costs nothing.
- The lab checks your work like a site test, so you know when it is right.
- Free, in your browser, with nothing to install.
Why learn with EDWartens
What you get with this course, and what comes after it.
- Free from the first lesson to the final assessment.
- Practice in a free 3D lab in your browser, with nothing to install.
- Video lessons with written notes and a project.
- An optional certificate that anyone can verify online.
- Free internships to keep practising afterwards.
Common questions
Do I need to know cybersecurity already?
You need the basics: IP addresses, ports, what a log is and the CIA triad. If those are new, take Cybersecurity Fundamentals first, then this course.
Is this a Splunk certification course?
No. It teaches the Splunk search skills a Level 1 analyst uses and is not affiliated with Splunk. It is not preparation for a specific Splunk exam, and the EDWartens certificate is not a Splunk certification.
Do I have to pay for Splunk?
No. The Splunk Enterprise trial is free for 60 days and can then be converted to Splunk's free licence, which allows 500 MB of data a day on a single instance. That is plenty for the labs and the BOTSv1 dataset.
Can I do the labs on a work laptop?
Use your own machine or a personal virtual machine. Practice captures and phishing samples can contain live malware, and some organisations do not allow security tools on their devices.
Is the SOC Analyst Level 1 with Splunk course really free?
Yes. Every module, the notes, the project and the final assessment. The only paid item is the certificate, if you want it.
What certificate does the SOC Analyst Level 1 with Splunk course give?
An EDWartens Certificate of Completion, issued when you pass the final assessment, with a number anyone can verify on our site.
How long does the SOC Analyst Level 1 with Splunk course take?
About 7.7 hours of video lessons, notes and practice questions, plus about 10 hours if you do the project. At an hour a day, that is about two and a half weeks.
What is the project in the SOC Analyst Level 1 with Splunk course?
You investigate an overnight RDP intrusion at a lending company as the Level 1 analyst on shift. You reproduce the events in your own lab, trace them with SPL, and write a triage playbook, an indicator register, an incident report with an ATT&CK mapping, and a detection gap register.
Do I have to use the lab?
No. The lab is optional practice. You can skip it whenever you like, and it never blocks your progress, the final assessment or your certificate.
Is the lab free?
Yes. Every lab level for this course opens in your browser, free, with nothing to install.
What topics does the SOC Analyst Level 1 with Splunk course cover, module by module?
The SOC Analyst Level 1 with Splunk course has 9 modules. It opens with "What a SOC analyst actually does", goes through "The incident response process", "Splunk search basics and SPL", "Network traffic with Wireshark" and "MITRE ATT&CK and threat intelligence" and ends with "Final Assessment". The full list with minutes is under "What you learn" on this page.
What can I do after the SOC Analyst Level 1 with Splunk course?
After the SOC Analyst Level 1 with Splunk course: Describe the SOC analyst's job, tools, verdicts and metrics; Follow the incident response process and contain without losing evidence; Read Windows logon, account and process event IDs. These are the practical outcomes the course is written around, and the final assessment of 15 questions checks them.
What software and hardware do I need for the SOC Analyst Level 1 with Splunk course, and does it cost anything?
For the SOC Analyst Level 1 with Splunk course, software: Splunk Enterprise (the free 60-day trial, which can convert to the free licence), the public Boss of the SOC v1 dataset, Wireshark, and a Windows virtual machine for Event Viewer. All free. Hardware: A laptop or desktop with 16 GB of RAM is comfortable for Splunk and a Windows VM together; 8 GB works if you run them one at a time. The course itself is free.
Is the SOC Analyst Level 1 with Splunk course suitable for me, and what level is it?
SOC Analyst Level 1 with Splunk is rated beginner. Beginner, with the basics in place. You should know what an IP address, a port and the CIA triad are; Cybersecurity Fundamentals covers them if not. It is written for aspiring SOC analysts, IT support staff and security students, and takes about 7.7 hours at your own pace.
Which jobs use the skills from the SOC Analyst Level 1 with Splunk course?
Skills from the SOC Analyst Level 1 with Splunk course (for example: describe the SOC analyst's job, tools, verdicts and metrics) are used in roles such as OT security analyst, security engineer, network engineer and compliance analyst, and in SOC analyst work. The course gives you practical evidence of the skill; it does not promise a job, and employers decide on experience and interview.
Start free today
SOC Analyst Level 1 with Splunk, at your own pace. Add the certificate only if you want one.