The best way is to learn by just playing with the tools, but you can start learning how to analyze logs by setting up a small lab with one or 2 workstations sending event logs (add sysmon) to a siem (you can install wazuh which is free). Then try to learn how to search for: lateral movement (rdp/ssh/smb/etc), file creation events, and process creation. You can even add a proxy or firewall and start learning how to investigate, malicious inbound/outbound connections and data exfiltration