Capstone · Cyber Security: from zero to SOC analyst
Capstone: a mini SOC toolkit for a clinic
The brief
Sunrise Multi-speciality Clinic in Kochi has no security team, and something odd happened last night. You build a Python toolkit that finds leaked passwords, changed and new files, a brute-force attack that succeeded, traffic to known-bad addresses, scores each finding and prints one clear report. Then you take a real integrity baseline on your own Linux VM and write it all up for your portfolio.
Why it matters
Small hospitals, clinics and diagnostic labs hold sensitive health data and are frequent ransomware targets, yet rarely have a SOC. Managed security providers and in-house analysts do exactly these checks. A working toolkit with a clear write-up is strong evidence in a SOC analyst interview.
Skills you practise
- hashing and leaked-password checks
- file integrity monitoring
- log parsing with regular expressions
- brute-force detection
- CIDR checks
- IOC matching
- severity scoring
- incident reporting
You need
- For step 10: your own Linux VM (Rocky, AlmaLinux, RHEL, Ubuntu or Kali) with sudo access
What you will have at the end
A GitHub-ready mini SOC toolkit: soc_toolkit.py with nine tested checks, a README with the attack timeline, ATT&CK mapping and recommended actions, and a real file-integrity baseline from your own VM.
How it is marked (rubric, 100 points)
| Toolkit worksEvery check passes: hashing, leaked passwords, integrity, parsing, brute force, networks, IOCs, severity and the report. | 40 |
|---|---|
| Joins the evidenceThe write-up links the brute force, the breached password, the changed files and the IOC into one story with a timeline. | 20 |
| Response planActions are concrete and in the right order, including CERT-In reporting and checking backups. | 20 |
| Portfolio qualityClean code, a clear README, a real baseline from your VM, and no sensitive data in the repository. | 20 |
0/11 steps done
Step 1 of 11
A hash helper
sha256_hex(text) returns the SHA-256 hash of the text as 64 hex characters.
Several checks compare fingerprints, so start with one helper. Encode the text as UTF-8 bytes, hash it with hashlib.sha256 and return .hexdigest().
Run shows what your code prints. Check runs the step's tests. Ctrl+Enter checks too.