Bhavesh More

SOC Analyst Intern

CyberSecXperts

Nov 2025 - May 2026

Monitored and triaged security alerts generated by SIEM, EDR, firewall, IDS/IPS, proxy, email security, and WAF solutions. Performed initial L1 investigation by reviewing source and destination IPs, users, hosts, ports, protocols, severity, and event timelines. Analyzed Windows, Linux, authentication, DNS, endpoint, network, firewall, and proxy logs to identify suspicious activity. Investigated brute-force attempts, suspicious logins, malware alerts, port scans, policy violations, and abnormal network traffic. Performed phishing-email analysis using sender details, headers, URLs, attachments, domains, file hashes, and reputation checks. Investigated endpoint alerts in CrowdStrike Falcon and Microsoft Defender for Endpoint and documented supporting evidence. Collected and validated indicators of compromise, including malicious IPs, domains, URLs, email addresses, and file hashes. Enriched alerts with threat-intelligence sources and classified them as true positive, false positive, benign positive, or informational. Created and updated incident tickets with investigation findings, evidence, actions taken, recommendations, and accurate timelines. Escalated confirmed, high-risk, or complex incidents to L2 analysts according to SOPs, playbooks, SLAs, and escalation procedures. Supported SIEM rule validation and tuning by identifying recurring false positives and documenting improvement recommendations. Prepared daily and weekly SOC reports covering alert volumes, incident status, investigation outcomes, and security trends.