A SOC analyst spends the day on one question: is this alert real? Every project on your resume should help the person reading it answer that question about you.
That is the idea behind this guide. You get six SOC analyst projects built around a real alert and a clear verdict, all using free tools. You also get a simple way to write each one up for your resume and GitHub.
What do recruiters look for in SOC analyst projects?
Quick answer: The best SOC analyst projects are investigations, not installations. Build six: phishing triage, a malware traffic investigation, a Wazuh home lab, an attack-and-detect test, a Splunk dataset and a Security Onion alert review. End each with a verdict and a short escalation note.
A SOC is a security operations centre, the team that watches alerts around the clock. According to Palo Alto Networks, a Tier 1 analyst reviews alerts and decides whether each is valid or a false positive. They rank alerts by criticality and escalate what they cannot resolve. Wiz adds that they document every finding and follow written playbooks.
So your projects should show the same four moves. Spot, check, decide, hand over.
| What a Tier 1 analyst does | What your project should show |
|---|---|
| Reviews an alert | The raw log line or packet that triggered it |
| Separates real from false alarm | Your evidence and your verdict |
| Ranks by risk | A priority, with one reason |
| Escalates | A short handover note to the next tier |
For the full job description, read our guide to SOC analyst roles and responsibilities.
Which SOC analyst projects should beginners build?
Build them in this order, from lightest to heaviest. One safety rule first: work only inside your own lab. Treat every downloaded capture or sample as hostile and open it inside a virtual machine, never on your main laptop.
Project 1: Triage three phishing emails
Take three suspicious emails from your own spam folder. Read the headers, check who really sent each one, and inspect every link without clicking it. Then look up the link or file on VirusTotal. Its free public API allows 4 requests a minute and 500 a day, and VirusTotal bars commercial use, which is fine for learning.
Show: a verdict for each email, the clues behind it, and what you would tell the user who received it. Phishing is daily Tier 1 work, and this needs no installation at all.
Project 2: Investigate a malware traffic capture
Malware-Traffic-Analysis.net publishes traffic analysis exercises with packet captures. The site tells newcomers to start with the newest and work backwards. Open one in Wireshark and answer three questions: which machine was infected, what did it contact, and what happened first? Our guide to Wireshark and its filters will speed you up.
Show: a timeline table, the infected host, and your recommended next step.
Project 3: Build a home SOC with Wazuh
Wazuh is a free, open source platform that combines SIEM and XDR. A SIEM collects logs from many machines and raises alerts. Wazuh also covers file integrity monitoring, vulnerability detection and mapping to MITRE ATT&CK, a free public catalogue of attacker techniques (MITRE).
Install it, then connect a Windows virtual machine. Add Sysmon, a free Microsoft tool that logs every new process with its full command line. Sysmon only records. It does not analyse anything, and network connection logging is off by default, so switch it on. Now fail a few logins on purpose and create a new user.
Show: three alerts, each explained in plain words.
Project 4: Attack your own lab, then check what you caught
Atomic Red Team is an MIT-licensed library of small tests mapped to MITRE ATT&CK. Run three of them on your lab machine. Then check whether Wazuh raised an alert for each.
Where it stayed silent, write a rule. Sigma is an open YAML format for describing suspicious log events, and its command-line tool converts rules into SIEM queries.
Show: a detection gap table with the technique, whether an alert fired, and the rule you wrote. Few beginners do this, so it stands out.
Project 5: Investigate the Boss of the SOC dataset in Splunk
Splunk’s Boss of the SOC v3 dataset is free under a CC0 license and 320.1 MB in size. It holds pre-indexed Windows event logs, Sysmon, AWS CloudTrail, Office 365 and Azure AD data. Splunk Enterprise gives you a 60-day trial at 500 MB a day, then a perpetual free license.
Expect setup friction. The dataset page names Splunk 7.1.7 as its tested version and lists add-ons you must install, so read it fully before you start. Pick one question, such as a suspicious sign-in, and chase it through the logs.
Show: an incident timeline with the search you ran at each step.
Project 6: Review alerts in Security Onion
Security Onion is a free platform bundling Suricata for intrusion detection, Zeek for network logs, full packet capture, alert dashboards and case management. It is the heaviest lab here, so save it for last.
Replay the capture from Project 2 through it. Compare its alerts with what you found by hand, then open a case and close it.
Show: where the tool agreed with you, where it missed, and your closing note.
How many projects are enough?
Three finished and written up beat six half-built. Pick one light project, one lab project and one dataset project, and document each properly.
What should SOC analyst projects on GitHub look like?
Use one repository per project, with the README first. Put the goal, the setup, two screenshots, your queries or rules, and the five-heading report in it. Redact anything personal.
Do not upload malware samples, real passwords or private email content. Pin your three best repositories, then link them from your CV and LinkedIn. This is also the strongest answer to “tell me about a project” in an interview for cybersecurity jobs for freshers.
Do I need a certification as well as projects?
Projects show you can work an alert. A certification shows you studied a syllabus. Wiz’s Tier 1 guide cites Security+ and CySA+ as common. See our cyber security certifications guide for current fees.
Tier 1 is also the start of a path. Palo Alto describes Tier 2 as incident responder and Tier 3 as threat hunter. Our cyber security roadmap and SOC analyst salary guide show where each step leads. For more general ideas, see our list of cybersecurity projects and the core cybersecurity analyst skills.
SOC analyst projects FAQs
1. What are good SOC analyst projects for beginners?
Start with phishing email triage and a malware traffic capture in Wireshark. Both need no server. Then build a Wazuh home lab. Each gives you a verdict and a written report.
2. Which free tools do I need for SOC projects?
Wireshark, Wazuh, Sysmon, Atomic Red Team, Sigma, Splunk Enterprise’s free license and Security Onion are all free. VirusTotal’s public API is free for learning, within its limits.
3. Can I build SOC projects without a paid lab?
Yes. Every project here runs on free software and your own laptop. You need virtual machine software and enough memory, with Security Onion being the heaviest.
4. How do I put SOC projects on a resume with no experience?
Add a Projects section with one bullet each, naming the tool, the data and the verdict. Label them as lab work, and link the GitHub repository.
5. What should SOC analyst projects on GitHub include?
A README with the goal, setup, screenshots, queries or rules, and your report. Leave out malware samples, passwords and personal data.
6. Are these projects enough to get hired?
They help you pass the screen and give you something to discuss, but no project guarantees a job. Pair them with core networking knowledge and, ideally, an entry-level certification.
7. How are SOC analyst projects different from general cybersecurity projects?
They end in an alert verdict and a handover, not in a vulnerability scan. For wider ideas such as web or cloud testing, see our guide to cybersecurity projects.
8. Is it legal to run Atomic Red Team?
Only on machines you own or have written permission to test. Run it inside your own lab virtual machines, never on a work, college or shared system.
9. What is the SOC analyst career path?
It usually starts at Tier 1 triage, moves to Tier 2 incident response, then Tier 3 threat huntingd, an later SOC manager. Pace depends on the employer and your hands-on skills.
Sources
- Palo Alto Networks, Security operations center roles and responsibilities: https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/security-operations-center-roles-and-responsibilities
- Wiz, Tier 1 SOC analysts: https://www.wiz.io/academy/soc-analyst-tier-1
- VirusTotal, Public vs Premium API: https://docs.virustotal.com/reference/public-vs-premium-api
- Malware-Traffic-Analysis.net, Traffic analysis exercises: https://malware-traffic-analysis.net/training-exercises.html
- Wazuh documentation, Getting started: https://documentation.wazuh.com/current/getting-started/index.html
- MITRE ATT&CK: https://attack.mitre.org/
- Microsoft Learn, Sysmon: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- Red Canary, Atomic Red Team: https://github.com/redcanaryco/atomic-red-team
- SigmaHQ, Sigma: https://github.com/SigmaHQ/sigma
- Splunk, Boss of the SOC v3: https://github.com/splunk/botsv3
- Splunk Enterprise download and trial terms: https://www.splunk.com/en_us/download/splunk-enterprise.html
- Security Onion documentation: https://github.com/Security-Onion-Solutions/securityonion-docs/blob/2.4/introduction.rst
- NIST, SP 800-61 Revision 3: https://csrc.nist.gov/news/2025/nist-revises-sp-800-61
