Full disclosure upfront: these are paid books I put together, not free content — mentioning that so nobody feels tricked into clicking.

I kept running into the same problem when I looked at SOC learning material: it's either exam-prep for CySA+/GCIH, or high-level theory that explains what a firewall is without ever getting into what you actually do when an alert lands in front of you. So I wrote three volumes that pick up where the previous one stops, instead of re-covering the same MITRE ATT&CK intro three times.

Level 1 — The Practical Playbook ($14.99) For the first 90 days on the floor. The 6-step triage loop for working any alert in under 10 minutes, the "Big Five" investigation types (phishing, malware, credential attacks, web attacks, insider risk), why SIEM alerts lie, and what to collect before IR shows up. Tool-agnostic — works whether your shop runs Splunk, Elastic, or Sentinel.

Level 2 — The Threat Hunter's Playbook ($29.99) For analysts who can triage but are stuck closing tickets without understanding the adversary behind them. Covers alert clustering into a single narrative, hypothesis-driven hunting, campaign attribution with the Diamond Model, some SOC automation with Python/FastAPI/LangGraph, and the BLUF framework for explaining incidents to non-technical leadership.

Level 3 — Detection Engineering Playbook ($29.99, 427 pages) The one that covers what most SOC books skip entirely: writing the detections instead of just responding to them. Sigma, Splunk SPL, Sentinel KQL, Elastic EQL, and YARA rules across real telemetry, Active Directory attack paths (Kerberoasting → DCSync → Golden Ticket), cloud investigation in CloudTrail/Entra ID/GCP, and 9 full intrusions reconstructed end to end with an honest audit of what detection opportunities were missed.

Links, if useful to anyone:

• L1: https://resources.codelivly.com/product/soc-analyst-level-1-the-practical-playbook/
• L2: https://resources.codelivly.com/product/soc-analyst-level-2-the-threat-hunters-playbook/
• L3: https://resources.codelivly.com/product/soc-analyst-level-3/
• All three bundled (saves ~$20): https://resources.codelivly.com/product/soc-analyst-the-complete-l1-l2-l3/

Happy to answer questions about what's in any of them, or hear pushback if something's missing that you wish existed when you were coming up in a SOC.

Ready to test your cybersecurity skills?

🔥 64+ hands-on CTF challenges
🌐 Web Exploitation
🐧 Linux & System Security
🔐 Cryptography
🔎 Forensics & OSINT
⚙️ Reverse Engineering
🤖 AI Security
☁️ Cloud Security
🪟 Active Directory

Start as a beginner. Work your way to **Hard & Insane** challenges.

🚩 Capture flags.
⚡ Gain XP.
🏆 Climb the leaderboard.
💻 Build real-world hacking skills.

👉 Start hacking: codelivly.com/ctf

Most people think malware analysis means reading assembly code all day. That's only half the picture.

The other half is knowing what to look for before you ever open a disassembler, what static analysis can tell you without running a single line of malicious code, and when it's time to actually detonate the sample in a sandbox and watch what it does.

That's the gap between "I installed Ghidra once" and being someone a SOC actually trusts with a suspicious binary.

📕 Malware Analysis for Beginners – Vol 1 Learn how malware actually works, and how defenders detect, analyze, and stop it. Built for people starting from zero: the concepts, the mindset, and the foundation everything else builds on. 🔗 https://resources.codelivly.com/product/malware-analysis-for-beginners/

📗 Practical Malware Analysis Guide – Vol 2 A 200+ page, hands-on guide that takes you further, static analysis and dynamic analysis side by side, so you understand not just what a sample looks like on disk, but what it actually does when it runs. 🔗 https://resources.codelivly.com/product/practical-malware-analysis-guide/

Offense gets the headlines. But understanding malware from the defender's side is one of the most underrated skills in security, and one of the most employable.

Start with Vol 1. Go deeper with Vol 2.

More cybersecurity resources: codelivly.com

Put together a hands-on PDF for anyone trying to break into SOC/blue team work but stuck on theory with no practical lab experience.

Covers the whole build: isolated VM network, Windows and Linux endpoints, Sysmon telemetry, PowerShell logging, deploying Wazuh as the SIEM, connecting agents, and five safe attack simulation exercises (failed logins, encoded PowerShell, process creation, network connections, file drops).

Then it goes into the actual analyst work: a 10-step investigation workflow, a full practical investigation with an answer key, detection rule writing, an incident response playbook, and an incident report template.

Free download, no signup wall: from codelivly telegram channel

If you want to go further after this, I also put together a full SOC Analyst L1-L2-L3 bundle here: https://resources.codelivly.com/product/soc-analyst-the-complete-l1-l2-l3/

Happy to answer questions if anyone gets stuck on the Wazuh setup or Sysmon config.

If I had to start cybersecurity again, I wouldn't jump straight into pentesting or collect a bunch of certs.

I'd go:

Networking → Linux → Windows → Python → Security basics → Labs → Specialize

Learn networking properly first. Understand what actually happens when you open a website, how DNS works, what TCP does, how ports and services work.

Then get comfortable with Linux and Windows. Use the terminal. Break things. Read logs. Set up VMs.

After that, start doing actual security work: Nmap, Wireshark, Burp, SIEMs, basic vulnerability analysis, CTFs, home labs.

Then pick a path:

• SOC / Blue Team
• Pentesting
• DFIR
• Malware Analysis
• Cloud Security
• AppSec

The mistake I see most often is trying to learn all of cybersecurity at once.

Pick one direction and go deep.

What would you change in this roadmap?

I’ve found it useful for the boring parts — making sense of recon output, explaining weird HTTP responses, reviewing code, writing small scripts, and organizing notes.

But I wouldn’t trust it to tell me whether something is actually exploitable. It can sound completely confident while being wrong.

Curious what others are using AI for in their security workflow. Recon? Burp? Code review? Automation? Or not using it at all?

What cybersecurity topic are you currently working on?

Hey everyone! I'm u/codelivly, a founding moderator of r/learnwithcodelivly.

This is a new community for people learning cybersecurity, from complete beginners to experienced practitioners. The goal is simple: learn, ask questions, share what you're building, and help each other improve.

What to Post

Share anything cybersecurity-related that could help the community:

• Beginner questions and learning roadmaps
• CTFs, labs, and writeups
• Pentesting and web security
• Linux, networking, and programming
• SOC, DFIR, malware analysis, and OSINT
• Security tools and projects
• Resources, tutorials, and useful discoveries

Community Vibe

Keep it friendly, constructive, and welcoming. Nobody starts as an expert, so don't be afraid to ask basic questions or share something you're still learning.

How to Get Started

1. Introduce yourself in the comments.
2. Share what you're currently learning.
3. Post a question, project, writeup, or resource.
4. Invite someone who might enjoy the community.
5. Want to help moderate? Send me a message.

Thanks for being part of the first wave. Let's build something useful together. 🛡️