After completing the SOC Level 1 learning path on TryHackMe, I wanted to move beyond simulations and practice defensive work using real data. Artificial intelligence can assist with repetitive tasks such as reviewing large quantities of logs, but analysts still provide context, verification, documentation, and judgment. I want to strengthen that human side of the process.
I began by hardening and monitoring my home network. I also reviewed my Windows and antivirus logs and established a routine for checking them. I was glad to find no obvious signs of a current problem, but that left me looking for another safe, practical project that could help sharpen my SOC skills.
Finding a Real-World Dataset
Next, I turned to the spam folder in my Gmail account. That is where I began finding messages worth investigating. Gmail had already filtered them away from my inbox, but simply ignoring or deleting suspicious messages would not teach me how to examine them.
At the time of this writing, the folder contained more than 120 messages. That does not mean every message was malicious. A spam folder can contain unwanted advertising, low-quality marketing, scams, phishing attempts, and even legitimate mail that was classified incorrectly. However, it gave me a useful set of messages to triage and classify.
The First Collection Problem
My first challenge was collecting the messages in a format suitable for investigation. Google supports exporting Gmail data through Google Takeout, including message content, headers, attachments, and Gmail labels such as Spam. However, I ran into a problem while trying to complete the export using the options available in my account.
Rather than conclude that bulk export was impossible, I treated this as a workflow problem that still needed troubleshooting. For my first pass, I decided to download selected messages individually as .eml files. Gmail allows individual messages to be downloaded in this format, which preserves information that can be useful during an investigation.
There is also a time limit to consider: Gmail automatically deletes messages that remain in Spam for more than 30 days. That means I need a repeatable collection process instead of relying on the spam folder as permanent storage.
Handling Suspicious Email Safely
Every message in this project will be treated as untrusted. My basic precautions include:
- Keeping automatic loading of remote images disabled.
- Not clicking links inside suspicious messages.
- Not replying to the sender.
- Not opening or running attachments.
- Saving investigation files separately from important personal files.
- Recording only the information needed for analysis.
- Removing personal details before publishing examples or results.
These precautions reduce risk, but they do not eliminate it. Anyone examining suspicious email should use an isolated analysis environment and appropriate security tools rather than casually opening files on a primary computer.
What Comes Next
The next step is to create a consistent process for collecting and documenting the messages. I will need to decide which details to record, such as the visible sender name, actual sender address, Reply-To address, authentication results, links, attachment types, dates, and the reason each message appears suspicious.
I will also need a safe system for collecting new samples before Gmail removes them. Once the messages are organized, I can begin looking for patterns and documenting the investigation process without exposing private information.
I will continue the series when the first set of messages is safely collected and ready for analysis.
Strengthen the network behind your investigation: Before analyzing suspicious email, make sure the network and devices you use have a solid security foundation. Read The Complete Home Router Security Guide: Audit, Protect, Monitor, and Improve Your Network.