SOC Analyst Tools: SIEM, EDR, SOAR and Ticketing

SOC analyst tools look overwhelming from the outside. Job posts list a dozen product names, and every vendor claims to do everything. The way through is to stop memorizing brands and start sorting tools by the question each one answers. Once you can say what a SIEM, an EDR and a SOAR platform are for, every product page becomes easier to read.

This is Part 2 of 30 in the Blue Team Learning Path. Part 1 explained what a SOC is and how an alert moves through it. Here we map the tools onto that workflow and finish with a free toolkit you can build at home.

Key takeaways

• Learn tools by the question they answer, not by the brand name.
• A SIEM correlates logs, an EDR watches endpoints, network monitoring watches traffic, SOAR automates response steps, and a ticketing system tracks the case.
• A free SOC analyst toolkit exists: Sysmon, Wazuh or Elastic, Zeek, Suricata and Wireshark cover most of the categories.
• Concepts transfer between products. Learn one SIEM well and the next one takes days, not months.

SOC Analyst Tools by Job, Not by Brand

Every tool in a SOC exists because an analyst needs an answer to a specific question. Start from the question and the product category follows:

• What do all my logs say, together? A SIEM collects logs from many sources and lets you search and correlate them.
• What is this endpoint doing right now? An EDR agent records process, file, registry and network activity on the host.
• What is crossing the network? Network monitoring tools such as Zeek and Suricata turn traffic into logs and alerts.
• Is this indicator known? Threat intelligence and reputation lookups add outside context.
• Can this step be automated? A SOAR platform runs playbooks that enrich alerts, open tickets and trigger actions.
• Who owns this case? A ticketing or case management system tracks status, evidence and handovers.

SIEM, EDR and SOAR Compared

These three get confused more than any others. The table puts the SIEM vs EDR vs SOAR question in one place.

Tool type	Main question	Data it works on	Typical output
SIEM	What do all my logs say, together?	Logs from servers, endpoints, firewalls, identity systems and applications	Searches, dashboards, correlation alerts
EDR	What is this endpoint doing?	Process, file, registry and network telemetry from agents on hosts	Detections, process trees, host isolation
SOAR	Can this response step be automated?	Alerts plus APIs of other tools	Playbook runs: enrich, ticket, notify, block

Two points that save beginners time. First, a SIEM is only as good as the logs sent to it, so log sources and parsing matter more than the product logo. Second, an EDR and a SIEM overlap but do not replace each other: the EDR sees deep into one host, the SIEM sees shallowly across everything. Most mature SOCs run both.

What Each Tool Sees in a Single Alert

Here is an illustrative scenario, not a real incident. A user opens a malicious attachment. Each tool sees a different slice of the same event:

1. The EDR records that the document application started a command shell, which is rarely normal, and raises a high-severity alert with the process tree.
2. The SIEM correlates a successful sign-in from an unusual location for the same user earlier that day.
3. Network monitoring logs a DNS lookup for a domain the organization has never contacted.
4. A SOAR playbook enriches the domain and the IP address with reputation data and opens a ticket with the findings attached.
5. The analyst reads the ticket, confirms the chain, isolates the host and escalates.

No single tool had the full story. The analyst’s skill is putting the slices together, which is why the rest of this path teaches the underlying data (Windows and Linux logs, Sysmon, network traffic) before the products.

Pick the Tool by the Question

When you are staring at an alert, this lookup is more useful than any product list:

Question                                     Start with
Who logged in, from where, and when?         SIEM (authentication logs)
What did this process launch?                EDR, or Sysmon process creation events
Did this host talk to a suspicious domain?   DNS logs, Zeek dns.log, proxy logs
Is this file hash known to be bad?           Reputation lookup or threat intel platform
What does this packet capture contain?       Wireshark
Who owns this case and what is its state?    Ticketing system

A Free SOC Analyst Toolkit You Can Build Today

You can practice every category above without paying for a licence. These are the tools this learning path uses, with the Part where each one is covered. Always check each project’s current license and system requirements before you deploy it.

• Sysmon: Microsoft’s free Sysinternals tool that writes detailed Windows process, network and file events to the event log. See Parts 11 and 12, and the Sysmon documentation.
• Wazuh and the Elastic Stack: open SIEM and XDR options you can run in a lab. Wazuh is covered in Part 14, and its documentation is a good place to start now.
• Splunk: widely used in industry, so worth learning even if you run something else at home. Part 13 covers search basics.
• Zeek and Suricata: open-source network monitoring, in Parts 22 and 23.
• Wireshark: packet-level inspection, in Part 9. For attack-side background, see our Wireshark guide.
• MITRE ATT&CK: not a tool you install, but the shared vocabulary analysts use in tickets. The ATT&CK site is free, and Part 6 shows how to use it.

Part 10 puts the pieces together into a blue team home lab. If you are new to reading Windows logs, start with Windows Event Logs 101 before touching a SIEM.

How the Tools Fit the SOC Workflow

Map the tools onto the six workflow stages from Part 1 and the picture clears up:

• Detect: SIEM rules, EDR detections and network alerts.
• Triage: SIEM searches and enrichment lookups to decide if the alert is real.
• Investigate: EDR process trees, endpoint logs and packet captures.
• Contain or escalate: EDR host isolation, firewall or account changes, and SOAR actions.
• Document: the ticketing or case management system.
• Tune: editing SIEM and EDR rules based on what the case taught you.

Open-Source vs Commercial SOC Tools

You will meet both kinds in the real world, and neither is automatically better. Open-source tools such as Wazuh, Zeek and Suricata carry no licence fee and let you see exactly how their detections work, but you take on deployment, tuning, upgrades and support yourself. Commercial platforms bundle support, integrations and polished interfaces, but you pay for them and are limited to what the vendor exposes.

Factor	Open source	Commercial
Cost	No licence fee, but staff time and hardware	Licence or subscription fees
Support	Community and documentation	Vendor support contracts
Customization	Full access to rules and configuration	Depends on what the vendor exposes
Setup effort	Higher, you build and maintain it	Lower, often hosted
Learning value	High, you can read and change detection logic	High for the product, narrower for the concepts

For learning, open source has a clear advantage because you can break it, rebuild it and read its rules. For an employer, the deciding factors are usually staffing, budget, compliance requirements and the tools already in place. A candidate who understands the concepts behind both is easier to hire than one who has only clicked through a single vendor’s interface.

Reading a SOC Job Description Without Panic

Job ads love long tool lists. Translate them by category instead of by brand. A line asking for Splunk, QRadar or Microsoft Sentinel means you can search and correlate logs in a SIEM. A line naming CrowdStrike, Defender for Endpoint or SentinelOne means you can read an EDR process tree and isolate a host. A line naming ServiceNow or Jira means you can write a clear ticket and hand a case over cleanly.

When you apply, describe the category you have practiced and the lab you practiced it in, then show a short example such as a triage ticket. Because the concepts transfer between products, that is more convincing than a list of logos, and it keeps your claims honest about what you have actually used.

Common Pitfalls When Learning SOC Tools

• Learning a brand instead of the concept. If you only know one vendor’s buttons, a new employer’s product feels foreign. Learn how searches, fields and correlation work.
• Collecting everything and parsing nothing. A SIEM full of unparsed logs is a storage bill, not a detection tool. Pick a few useful sources and make sure fields are extracted correctly.
• Trusting the severity label. A tool’s “critical” is a starting guess. Context such as the asset and the user decides the real priority.
• Ignoring log retention. If logs roll over in days, an investigation that starts a week late has nothing to read.
• Never testing detections. A rule that has never fired in a test may not work at all. Part 29 covers testing detections with Atomic Red Team.

What to Learn First

If you are early in this path, resist the urge to deploy a full SIEM tomorrow. A sensible order is: read Windows and Linux logs by hand (Parts 3 to 5), install Sysmon so the logs are richer, then learn searching in one SIEM, then add network monitoring. Understanding the raw data first makes every dashboard make sense instead of looking like magic.

Frequently Asked Questions