Receive an alert
Open a case with clear objectives and the evidence you need.
FirstShift beginner path
Learn the work behind the alert.
Tracework is interactive SOC analyst training built around realistic investigations. Review evidence, run guided commands and queries, decide with support, and document the work.
Domain: soctracework.com · Sign in required for the workspace
Investigation before lectures
Follow the evidence
Inspect process trees, network rows, files, and timelines.
Decide and document
Classify the activity and write an analyst-ready summary.
Preview the workspace
Create an account to open the FirstShift dashboard and the static Suspicious PowerShell investigation layout. Live terminal execution, KQL evaluation, and grading remain deferred.