SOAR Playbooks Aren't Scripts
Treating SOAR playbooks as pipelines, not scripts.
To Detect or Not to Detect
Guidelines for evaluating effective SOC detections.
Towards Actionable Detection
Actionable detection for relevant and contextual alerts.
Review: Practical Threat Detection Engineering
Review of Practical Threat Detection Engineering book.
Improving SecOps Beyond Tuning Analytics
Improving SecOps through alert tuning, contextualization, and automation.
Review: The Cuckoo's Egg
A 1980s Infosec thriller with groundbreaking investigations.
The Threat Detection Fundamental Dilemma
Exploring the precision vs. recall dilemma in threat detection.
Testing The Logfile Navigator (lnav)
Log analysis with lnav: challenges, insights, and tips.
Insights into Effective SIEM Deployment
Strategies and tips for successful SIEM deployment.
Understanding Severity vs. Priority
Find the best settings for consistent detection alerts.
Review: Intelligence-Driven Incident Response
How integrating CTI enhances Threat Detection and CSIRT.
Automating Incident Response
Tackling log centralization, SIEM, and IR automation.
Friction Between Red Teams and Incident Response
Reducing friction in Red Team cybersecurity exercises.
Query Security Services for IP Reputation
Query three security services for IP reputation in one script.
