Project · Cyber Security: from zero to SOC analyst
Project: investigate a phishing alert
The brief
The email gateway at a chartered accountants' firm in Pune flagged a fake "income tax refund" email during ITR season. As the L1 analyst you check the sender and its SPF, DKIM and DMARC results, find who clicked and who typed their details in, match the proxy log against threat-intelligence indicators, set the priority and write the incident ticket.
Why it matters
Phishing is the most common way attacks start, and refund and KYC scams spike around tax deadlines. Working an alert from evidence to a clear, prioritised ticket is the core daily task of a SOC L1 analyst, and the same steps appear in every phishing playbook.
Skills you practise
- email headers, SPF, DKIM and DMARC
- URL and host parsing
- proxy log analysis
- IOC matching
- triage and priority
- incident tickets
You need
- For step 7: a computer with nslookup (built into Windows, macOS and most Linux systems)
What you will have at the end
investigate.py, a tested triage script, and ticket.txt, a complete P1 incident ticket for a phishing attack, ready for a SOC portfolio.
How it is marked (rubric, 100 points)
| Investigation is correctAll checks pass: sender, authentication results, look-alike-safe domain matching, clicks, submissions and IOC hits. | 40 |
|---|---|
| Triage and priorityP1 with clear reasons; the second user (priya) and the second domain were found through IOC matching. | 20 |
| Ticket qualityFacts with times, affected users, containment steps and the CERT-In reporting decision; another analyst could act on it. | 25 |
| Email security understandingYou can explain SPF, DKIM and DMARC and read a real DMARC record. | 15 |
0/8 steps done
Step 1 of 8
Who really sent it
sender_domain(HEADERS) returns the domain of the From: address, in lower case.
The display name says "Income Tax Department", but anyone can type any display name. The address inside < > is what matters. Find the From: line, take the part between < and >, and return what follows the @. The real department sends from incometax.gov.in, so a different domain is the first red flag.
Run shows what your code prints. Check runs the step's tests. Ctrl+Enter checks too.