Up to this point the program has been about building and assessing systems. Week 8 flips the chair around. Now you are the person watching, and something is already happening.
This is the week most students discover whether defensive work is for them, because it is a different kind of thinking. Offense needs one path to work. Defense needs to notice one path among millions of ordinary events.
The Blue Team and the SOC
The blue team is everyone whose job is to detect, investigate, and respond. In a larger company that work is organized into a security operations center, which is usually staffed in tiers.
Tier one triages alerts and closes the obvious ones. Tier two investigates the ones that survive. Tier three handles the hard cases, hunts for what alerts missed, and often writes the detections. Our SOC guide covers the staffing model, the metrics, and the burnout problem that comes with alert volume.
The SIEM and the Logs That Feed It
A security information and event management platform does one obvious thing and one important thing. The obvious thing is collecting logs in one place. The important thing is normalizing them so a Windows authentication event and a firewall event can be compared in a single search.
The value of a SIEM is entirely determined by what you feed it. Authentication logs, endpoint telemetry, DNS queries, proxy or firewall traffic, cloud audit logs, and email security logs cover most real detection. Everything else is usually a cost problem.
Getting Into Splunk
Splunk is one of the most widely deployed SIEM platforms in the world, which makes it worth learning specifically. Its search language, SPL, reads like a pipeline: you start with a set of events and pass them through transformations.
You start with the basics. Search a term, filter by index and source type, pick out fields, count by a field, sort the counts, and look at what the top of the list tells you. Then time: what changed this week that did not happen last week.
The full explainer is in SIEM and Splunk explained, and there is more product background on our Splunk page.
Reading an Intrusion
Attackers leave traces because computers write things down. The skill is knowing which things.
Authentication that succeeds from an unusual place or at an unusual hour. A service account logging in interactively. A process spawning a command shell when it never has before. Outbound connections to a destination nobody has ever visited, at a regular interval. New scheduled tasks, new services, new accounts, or new members of an administrative group.
Each of those maps to a technique in MITRE ATT&CK, which is the shared vocabulary defenders use to describe what they saw.
What the Quiz Actually Tests
The Week 8 quiz is less about Splunk syntax than about whether you can say what a result means. You get search output and have to explain what it shows and what you would look at next.
That is the actual job. Running a search is easy. Deciding that the answer is boring, or that it is the start of something, is the part that takes practice.
Learn This at HackRange
Week 8 sets up Week 9, where you use these skills to reconstruct a full intrusion from log data with only one thread to start from.