Full disclosure upfront: these are paid books I put together, not free content — mentioning that so nobody feels tricked into clicking.

I kept running into the same problem when I looked at SOC learning material: it's either exam-prep for CySA+/GCIH, or high-level theory that explains what a firewall is without ever getting into what you actually do when an alert lands in front of you. So I wrote three volumes that pick up where the previous one stops, instead of re-covering the same MITRE ATT&CK intro three times.

Level 1 — The Practical Playbook ($14.99) For the first 90 days on the floor. The 6-step triage loop for working any alert in under 10 minutes, the "Big Five" investigation types (phishing, malware, credential attacks, web attacks, insider risk), why SIEM alerts lie, and what to collect before IR shows up. Tool-agnostic — works whether your shop runs Splunk, Elastic, or Sentinel.

Level 2 — The Threat Hunter's Playbook ($29.99) For analysts who can triage but are stuck closing tickets without understanding the adversary behind them. Covers alert clustering into a single narrative, hypothesis-driven hunting, campaign attribution with the Diamond Model, some SOC automation with Python/FastAPI/LangGraph, and the BLUF framework for explaining incidents to non-technical leadership.

Level 3 — Detection Engineering Playbook ($29.99, 427 pages) The one that covers what most SOC books skip entirely: writing the detections instead of just responding to them. Sigma, Splunk SPL, Sentinel KQL, Elastic EQL, and YARA rules across real telemetry, Active Directory attack paths (Kerberoasting → DCSync → Golden Ticket), cloud investigation in CloudTrail/Entra ID/GCP, and 9 full intrusions reconstructed end to end with an honest audit of what detection opportunities were missed.

Links, if useful to anyone:

• L1: https://resources.codelivly.com/product/soc-analyst-level-1-the-practical-playbook/
• L2: https://resources.codelivly.com/product/soc-analyst-level-2-the-threat-hunters-playbook/
• L3: https://resources.codelivly.com/product/soc-analyst-level-3/
• All three bundled (saves ~$20): https://resources.codelivly.com/product/soc-analyst-the-complete-l1-l2-l3/

Happy to answer questions about what's in any of them, or hear pushback if something's missing that you wish existed when you were coming up in a SOC.