What a SOC actually does is part of L1 · Alert Triage, which unlocks once you complete every lesson in SOC Foundations.

This keeps the curriculum sequenced: each phase builds on skills exercised in the one before it.