Laxmi Akkalkar

SOC Analyst

Godrej Industries Ltd

May 2024 - Present

Monitored and reviewed priority-based alerts from SIEM, EDR, firewall, VPN, proxy, IDS/IPS, email gateway, endpoint, and cloud log sources in a 24x7 SOC environment. Performed L1 alert triage including severity classification, true-positive/false-positive validation, ticket creation, evidence capture, and escalation as per SOC playbooks. Investigated phishing email alerts by analyzing sender details, email headers, URLs, attachments, domain reputation, email gateway logs, and user impact. Analyzed suspicious authentication activities such as brute-force attempts, failed login patterns, account lockouts, VPN anomalies, impossible travel indicators, and unauthorized access attempts. Reviewed malware and endpoint alerts by checking affected host details, logged-in user, file path, command line, process tree, hash value, parent-child process relationship, and alert timeline. Correlated SIEM logs with EDR, firewall, proxy, VPN, Windows security events, and email gateway logs to identify impacted users, affected hosts, source/destination IPs, and event sequence. Supported L2 investigation by preparing event timelines, validating IOCs, collecting log evidence, checking related alerts, and documenting investigation observations for senior analysts. Performed IOC-based analysis using IPs, domains, URLs, file hashes, usernames, and hostnames with reputation-checking platforms such as VirusTotal, AbuseIPDB, and URLScan. Assisted in MITRE ATT&CK mapping for common alert categories such as phishing, credential access, suspicious execution, command-and-control indicators, and lateral movement indicators. Supported incident response activities by recommending containment actions such as user password reset, host isolation request, malicious URL block, domain block, and firewall rule review based on investigation findings.