If You Want to Become a SOC Analyst, Learn These Linux Commands First

By Amardeep Maroli  ·  August 01, 2026  ·  Linux, SOC, System Administration  ·  24 min read

Home About Contact

Every single day at Inhok, I use Linux. Not as a hobby. As core SOC work. Log analysis, process monitoring, threat hunting, incident investigation — all Linux command line.

Most SOC training focuses on SIEM tools (Splunk, Wazuh). Nobody teaches Linux. But 70% of real SOC work happens in the terminal, not the GUI. You need to know Linux deeply.

This post covers 40+ Linux commands I use constantly. Not theoretical knowledge. Real commands, real use cases, real impact on SOC work.

What this covers: 40+ essential Linux commands for SOC analysts. Log analysis, process investigation, file analysis, networking, user management. Real examples from Inhok. Why each command matters. Performance tips.

Log Analysis Commands (The Core of SOC Work)

$ grep -r "error" /var/log/

What: Search for "error" across all logs. Why: Logs are massive. Need to find relevant entries fast.

grep -i "failed login" /var/log/auth.log | wc -l

Real use case: Attacker attempted 500+ failed logins last night. This command found them immediately.

$ tail -f /var/log/syslog

What: Follow log file in real-time (last 10 lines + new entries as they happen). Why: Investigating live incident? Watch logs as they appear.

tail -f /var/log/auth.log | grep "authentication failure"

Real use case: Monitoring SSH brute force attack in real-time during incident response.

$ awk '{print $NF}' file.log | sort | uniq -c | sort -rn

What: Count occurrences of last field, sort by frequency. Why: Find which values appear most (IPs, error codes, usernames).

cat access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -10

Real use case: Found top 10 source IPs attacking web server. 1 IP had 10,000 requests.

$ sed -n '100,200p' large_file.log

What: Extract lines 100-200 from huge file. Why: Log files are often 100GB+. Don't open them. Extract what you need.

sed -n '1000,2000p' /var/log/syslog | grep "kernel"

Real use case: Extracted specific time range from syslog without loading entire file.

Figure 1. Log analysis is one of the most common tasks in a Security Operations Center (SOC). Commands such as grep, tail -f, and awk help analysts quickly locate failed logins, authentication errors, and suspicious events within large Linux log files.

Process Investigation Commands

$ ps aux | grep -v grep | grep

What: Find running process by name. Why: See if malware is running. Check resource usage.

ps aux | grep -v grep | grep "unknown_process"

Real use case: Found suspicious process using 90% CPU. Killed it immediately.

$ lsof -i :8080

What: Show process listening on port 8080. Why: Find what's running on suspicious port.

lsof -i :22 | grep LISTEN

Real use case: Found unauthorized SSH service running on non-standard port.

$ strace -p

What: Trace all system calls of process. Why: See exactly what process is doing in real-time.

strace -p 1234 2>&1 | head -50

Real use case: Traced suspicious process and found it was exfiltrating data to C2 server.

Figure 2. During incident response, SOC analysts use commands such as ps, top, htop, and lsof to identify suspicious processes, monitor resource usage, and determine which applications are communicating over the network.

File Analysis Commands

$ file

What: Determine file type. Why: Attacker might rename .exe to .txt. File command reveals true type.

file suspicious_document.pdf

Real use case: Found "PDF" that was actually a Windows executable.

$ md5sum / sha256sum

What: Generate file hash. Why: Compare against known malware hashes. Identify if file is known malicious.

sha256sum malware.exe | awk '{print $1}'

Real use case: Checked hash against VirusTotal database. Found it was known ransomware.

$ strings

What: Extract readable strings from binary. Why: Find hardcoded URLs, IP addresses, commands in malware.

strings suspicious.bin | grep "http://"

Real use case: Found C2 server URL hidden in malware binary.

Network Investigation Commands

$ netstat -tupln

What: Show all listening ports and processes. Why: Find which services are exposed to network.

netstat -tupln | grep LISTEN

Real use case: Found 5 services listening on 0.0.0.0 (all interfaces). 2 shouldn't be exposed.

$ ss -tuln

What: Modern replacement for netstat. Faster, clearer output. Why: Better performance on systems with thousands of connections.

ss -tuln | grep :443

Real use case: Quickly identified all HTTPS listeners during incident response.

$ tcpdump -i eth0 'tcp port 443'

What: Capture network traffic on port 443. Why: Investigate suspicious network connections. See what data is being transmitted.

tcpdump -i eth0 -w capture.pcap 'tcp port 80 or tcp port 443'

Real use case: Captured traffic from compromised system. Found data exfiltration to attacker IP.

Figure 3. Network investigation commands such as netstat, ss, and tcpdump help analysts identify open ports, monitor active connections, and capture packets during security investigations and incident response.

Figure 4. A typical SOC investigation begins with an alert, followed by log analysis, process investigation, network analysis, evidence collection, and incident response. Linux command-line tools play a central role throughout each stage of the investigation.

📖 Related Posts

• CloudScanner : What Every SOC Analyst Must Know
• How to Hunt Attackers Using Attack Chains
• 5 Python Scripts I Actually Use for Security Tasks
• My Home Lab Architecture for SOC Training

Linux for SOC FAQs

Do I need to know all 40+ commands to be a good SOC analyst?

No. Master 10-15 core commands (grep, tail, awk, ps, lsof, netstat, tcpdump, find, cut, sort, uniq). Learn others as needed. Muscle memory matters — use them daily.

Which is more important: Linux or Windows?

Both. SOC analysts work with hybrid infrastructure. Know Linux deeply. Know Windows enough to investigate. In 2026, most infrastructure is Linux (servers, cloud). Most endpoints are Windows. Learn both.

About the Author

Amardeep Maroli

SOC Analyst at Inhok Technologies. Use Linux daily for log analysis, process investigation, incident response. 6+ months hands-on experience. Commands documented from real SOC work.

All Posts | Portfolio | GitHub | LinkedIn