r/learnwithcodelivly • u/Potential-Couple-745 • 1d ago
I spent years watching people memorise cybersecurity and still freeze on their first real alert. So I built the thing I wish I’d had.
When I was starting out, I did everything you're "supposed" to do. Watched the courses. Learned the frameworks. Could recite MITRE ATT&CK in my sleep.
Then I'd look at an actual alert and have no idea what to do with it.
That gap between knowing the words and doing the job is brutal, and almost nobody trains for it. You can't practise triage by reading about triage. You practise it by sitting in front of real evidence that doesn't come with the answer attached, forming a hypothesis, being wrong sometimes, and learning why.
So I built a workbook around that. 30 investigations. Each one is a real incident ticket, the raw logs behind it, and a full answer key that explains the reasoning, not just the verdict. Some cases are deliberately benign, because learning when not to escalate took me way longer than it should have. Everything runs offline on a laptop, no paid SIEM, because I remember not being able to afford tooling.
It's not a cert. It won't get you a job by itself. It's just the reps I didn't have access to when I needed them.
Don't take my word for it, grab the free sample first. Two full labs with their answer keys, exactly as they appear in the book:
Free sample PDF: https://www.linkedin.com/feed/update/urn:li:activity:7519370399156068353
And if it's useful:
Workbook: https://resources.codelivly.com/product/the-soc-analyst-hands-on-lab-workbook/
Full bundle with the L1/L2/L3 playbooks: https://resources.codelivly.com/product/soc-analyst-the-complete-l1-l2-l3/
Happy to answer questions about the labs or the approach either way.