SOC L1 Intern Struggles with Imposter Syndrome Due to Lack of Product-Specific Knowledge

The poster, a SOC L1 intern at a small MSSP, struggles with analyzing alerts requiring deep knowledge of specific products (e.g., Microsoft Exchange, Windows internals) despite understanding security concepts. They feel lost interpreting logs, determining normal behavior, and drawing conclusions from data, relying on L2 analysts for guidance. The intern has no prior SOC or IT experience, with a background in cybersecurity education, TryHackMe, and self-study. They seek advice on how others built familiarity with enterprise tools like Microsoft Sentinel, Defender, and Exchange Online.