Everyone says "build a Sigma rule" or "analyze some logs." That's a trap. You'll just make a rule that never fires because you don't know the environment.
Realistic first project? Pick one common alert from your EDR that generates constant noise. Don't touch the rule itself. Your job is to write the runbook for it.
Find the last 10 times it fired. Figure out:
* Exactly which business process caused it.
* Which user or service account is always involved.
* The legitimate parent process chain.
Then document how to confirm it's a false positive in under 60 seconds. If you can't, you've found your first real detection gap.
This will teach you the environment, the tool's blind spots, and how analysts actually work. Not another academic exercise.
Just saying.
Just saying.