🔄 Topic

Recognizing the shift from using commands to understanding systems.

🎯 Goal

Reflect on how individual troubleshooting steps connect into a broader investigative mindset.

🛠 What I Did

Over the past sessions, I worked on:

SSH troubleshooting
network connectivity testing
port verification
VM networking configuration

These were initially isolated problems.

The pattern that emerged is more useful than the individual commands. Each issue forced me to ask where the failure lived: host, service, network path, name resolution, credentials, or configuration.

🔗 Key Cybersecurity Connections

In real SOC work, issues are rarely isolated.

Instead, analysts must:

correlate signals
understand systems
connect multiple data points

🔍 Investigation Questions

What layer is failing?
Is this network, service, or configuration?
What evidence supports each hypothesis?

🚨 Detection Opportunities

correlation across logs
identifying patterns instead of single events
combining network + endpoint signals

🧭 MITRE ATT&CK Techniques

T1046 — Network Service Discovery
T1021 — Remote Services

⚠ Challenges

Moving from:

command execution
→ to
system understanding

📚 What I Learned

tools are only part of the process
investigation requires context
systems thinking is essential
the same symptom can come from several layers
good analysis means narrowing possibilities with evidence instead of jumping to the loudest explanation

➡ Next Steps

begin writing real detection rules
analyze logs from lab activity

🧠 Reflection

This feels like a transition point:

less “running commands”
more “understanding what’s happening”

🧩 Lessons Learned

What worked

Breaking problems into layers.

What broke

Seeing each issue as isolated.

Why it broke

Lack of system-level perspective.

Fix / takeaway

Always connect signals into a bigger picture.

That is the employable skill I am trying to build here: not memorizing tools, but using tools to make careful decisions under uncertainty.

📈 Skill Progression Context

This marks the shift toward real SOC-level thinking and investigation.

😄 TL;DR

It’s not about the command anymore…
it’s about what the command is telling you.