Who SOC Fluent is for
Anyone who needs to search security logs in a SIEM or EDR and wants to get good at it before it counts. Here’s how it helps at each stage.
Students and career starters
Learn to search security logs in the languages SOC jobs ask for, before your first SOC job.
You’re studying cybersecurity or just finished a course or cert, and you want your first job in a SOC or incident response. Most SOC job posts ask for SIEM or EDR experience, and much of that comes down to one skill, searching the logs to find what happened. A home lab takes weeks to build before you write a single query. Here you learn the query languages those tools use on realistic security data, from your first lesson.
How SOC Fluent helps
- Tracks start with warm-ups and build up to full hunts, so you can start from zero.
- Exercises are written as alerts and tickets, like the ones you’ll get on shift.
- Hints when you’re stuck, and checkpoints that show what you can do on your own.
Where to start
If you have an interview coming up, start with the tasks interviewers ask for, solved in each language. Then take the free first module of a track. If you’re not sure which, KQL is a good first pick because Microsoft Sentinel and Defender are common in SOC job posts.
Prepare for a SOC or security analyst interviewPricing
The Analyst plan unlocks every language and exercise. Students and people between jobs get it at half price.
See pricingSOC and security analysts
Learn your next query language before your first shift on it.
You know one stack well, but your next job or client may run another. Add a second language and you can apply for more roles, cover more clients, and move between stacks without starting over.
How SOC Fluent helps
- Solve the same exercise in KQL, Elastic and Sophos SQL, and compare your answers.
- A field map shows what each field is called in every language.
- Feedback points out the mistakes that catch people out, like case-sensitive matches.
Where to start
Pick the language of your next client or stack, and read the comparison with the one you already know to see what changes.
Compare the languagesPricing
The Analyst plan covers every language. If you only need one, a track pass is a one-off payment instead.
See pricingThreat hunters
Find what the alerts missed, in whatever tool the data lives in.
Hunting means asking your own questions of the data instead of waiting for an alert. You move fast between tables, look for what’s rare, and need to know a language well enough to trust an empty result.
How SOC Fluent helps
- Hunts built around real attacker behaviour, like Office starting a shell or a new scheduled task.
- Practise finding what’s rare, counting by device, and joining process and network data.
- Learn where each language quietly misses rows, so an empty result really means nothing’s there.
Where to start
Start with the language you hunt in most, and keep its cheat sheet open. Then practise the same hunts in the other languages, so you can follow the data wherever it lives.
Open the cheat sheetsPricing
The Analyst plan unlocks every language, so you can hunt across all of them.
See pricingSOC leads
Get new hires and your whole team fluent in a new language, with a track to follow.
Moving your in-house SOC to a new SIEM or EDR? Onboarding an MSSP client who runs a different SIEM or EDR? Assign your team that language and get them confident in it before the cutover. New hires get a track to train on from day one, so you know they understand how the language works before they’re on shift or working an incident.
How SOC Fluent helps
- Each track is a structured lesson plan with exercises after each lesson, so everyone learns the language the same way.
- Assign a track to your whole team in one go.
- See who’s ready and which exercises people get stuck on.
- Answers are checked on the rows a query returns, so any query that finds the right results passes.
Where to start
The Team plan is coming soon. Join the waitlist and tell us you lead a SOC or IR team, and we’ll get in touch.
Join the waitlistPricing
The Team plan is priced per seat, with a 5-seat minimum. It’s coming soon.
See pricingIncident responders
Scope the incident in whatever SIEM or EDR the client runs.
Clients don’t all run the same SIEM or EDR, and the middle of an incident is no time to learn a new one. Practise the core moves in each language so on day one you’re investigating, not reading documentation.
How SOC Fluent helps
- Investigation cases follow an attack from the first alert to its full scope.
- The same case in each language, so you can switch when the client runs something new.
- Cheat sheets for each language, made for quick lookups mid-engagement.
Where to start
Start with the investigation cases in the language you meet most, then work through the others before you need them.
See which language each tool usesPricing
The Analyst plan unlocks every language and every investigation case.
See pricingBe first in when it launches
Join the waitlist and we’ll email you once, on launch day. Tell us which SIEM or EDR you use and it helps us decide what comes first.
Free to join. Students get 50% off at launch.