✳ Learning path / 4 lessons
SOC operations and incident response
Four intermediate lessons take you inside Meridian’s Security Operations Center with Threat Hunter Nyx: prioritizing vulnerabilities by exploitability (EPSS, CISA KEV) and asset reachability, triaging identity anomalies against base rates, running the NIST SP 800-61 containment and verified recovery loop, and bounding AI assistants inside an Agentic SOC.
Work through the lessons in order to build a complete engineering mental model, or jump straight to the topic you are designing or reviewing today.
01Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure
Sorting a patch queue strictly by base CVSS score wastes scarce maintenance windows. Learn how SOC and engineering teams combine CVSS severity, CISA KEV active exploitation, EPSS probability, and asset exposure.
Identity alert triage: reconstructing who, what, and how across logs
When an anomalous login or privilege alert fires, SOC analysts pivot across IdP, device posture, and API telemetry to separate benign automation from active credential compromise.
Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof
A click on "Disable User" or a webhook call does not end incident response. NIST SP 800-61 Rev. 3 (April 2025) maps incident response to the CSF 2.0 Functions, and each containment action needs a read-back of live state.
Agentic SOC architecture: autonomous triage vs human-gated containment
AI agents in the Security Operations Center can accelerate log enrichment and timeline assembly, but untrusted telemetry can carry prompt injections and high-impact containment actions require deterministic policy gates.
Test your engineering judgment
Every lesson closes with a 4-choice scenario check modeled on real architectural trade-offs. Ready for full hands-on simulations or certification drills?
Open the practice labs ↗ · Launch the CISSP practice simulator ↗