#security-operation-center

BrandSentinel: Building an Automated Brand Impersonation and Typosquatting Detection Integration…

How I built a custom external domain threat intelligence pipeline that discovers look-alike domains, enriches their infrastructure…

Building a Lightweight Enterprise SOC Lab with Splunk, Sysmon & MITRE ATT&CK

How I built a practical SOC laboratory using VMware, Splunk Enterprise, Windows Server, Sysmon, Kali Linux, MITRE ATT&CK, automated…

I Built a Fake Login Page to Get Hacked on Purpose

Here’s What I Learned About Detection Engineering…

SOC137 — Malicious File/Script Download Attempt

LetsDefend Alert

TCP/IP Explained Through a SOC Analyst’s Eyes: From DNS to HTTPS

When I started working in cybersecurity, I realized something quickly:

𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗱𝗼𝗲𝘀𝗻’𝘁 𝘀𝘁𝗮𝗿𝘁 𝘄𝗶𝘁𝗵 𝘁𝗲𝗰𝗵𝗻𝗼𝗹𝗼𝗴𝘆.

Cybersecurity is not simply about deploying more tools. It is about understanding your vulnerabilities, identifying potential threats…

Starting a New Senior Cybersecurity Job? Don’t Start With the Tools

What to understand first when starting a senior role in cybersecurity

🌙 Nightwatch is live in detections.ai Enterprise

When new threat research lands, two questions get asked immediately:

SpottedInTheWild Lab — CyberDefenders

Objective: Reconstruct an attack timeline by analyzing disk images, event logs, and malicious scripts to identify initial access…

Detecting Password Spraying with Microsoft Sentinel and KQL: A Practical SOC Investigation

Investigating a Suspicious PowerShell Script Execution

TryHackMe: SOC in Blue Team — Where Security Operations Fits

https://tryhackme.com/room/socroleinblueteam

The Future of Security Operations Centers (SOC): How AI Is Transforming Threat Detection and…

How AI is making SOCs faster and smarter

Building a SOC Lab from Scratch: Part 1: Centralizing Windows Logs with Splunk

Introduction

Surviving 2+ Years of 24/7 SOC Shifts — Here’s What I Actually Learned

A genuinely honest breakdown from someone who came in panicking over 500 alerts — and left with a few things worth sharing.

Catching SSH Brute-Force Attacks Before They Escalate: Building a Detection & Response Workflow…

SSH is one of the most attacked services on the internet, and it makes sense why. It’s exposed, it’s common and there’s always a chance…

I Built an AI Copilot for Active Directory Security — Here’s What Broke First

Or: three mistakes that taught me more than the parts that worked.

Week 14: How the Internet Actually Moves Your Data — Routing, Switching, Firewalls & IDS/IPS…

You type google.com and hit Enter. In milliseconds, your request travels across the globe and comes back with a webpage. But how? And who’s…

Logs, Events, and Incidents — The Three-Tier Language of SIEM

By Odai Mherat

Three Things MDR Does Not Give You That AI SIEM Does

Jeff Darrington, Technical Marketing Director, Graylog

Advanced Packet Analysis -Wireshark & TShark

Triage alerts, reassemble streams, extract files, and detect protocol abuse via Wireshark & TShark.

Senior Security Analyst Intro (THM) Tryhackme Walkthrough

Description : Explore the duties and exciting opportunities of a SOC Level 2 analyst.

Senior Security Analyst Intro — THM WriteUp

Task 1: Journey to Senior

Splunk SPL Cheat Sheet: Operators and Data Representation

1. Main SPL Operators

EDR Explained: How Endpoint Detection and Response Detects Modern Threats

As organizations increasingly rely on digital devices and remote work environments, protecting endpoints has become more important than…

AI-Powered L1/L2 Triage: Helping SOC Analysts Focus on What Matters

After alert fatigue comes the next challenge: helping SOC analysts triage faster, prioritize better, and use AI to reduce repetitive…

Detection Engineering With Snort | TryHackMe | detection challenge

Build production-ready Snort detections: behaviour rules, tuning, suppression, and IOC lifecycle.

Building Muscle Memory in Cybersecurity: Understanding the Sentences, Missing the Paragraph

Today, I want to talk about a hidden struggle in cybersecurity: developing “reflexes and muscle memory.”

How to Calculate MTTD/MTTA in Elasticsearch

Description

DCOM Explained: How Attackers Turn a Windows Feature into a Lateral Movement Tool

A step-by-step breakdown of how attackers abuse Windows DCOM for lateral movement — and how to detect it

Field Notes from the Blue Side

A series documenting my hands-on journey through cybersecurity labs, investigations, and blue team exercises.

How I Passed OSDA After Two Failures

Hey everyone I wanted to share my experience with the OSDA (OffSec Defense Analyst) exam. To be totally honest with you all, I didn’t…

Week 11:- Ports & Protocols: The Hidden Language of the Internet

Introduction: Imagine Your Home Receives Mail

BunkerWeb Setup and First Tour: Complete Documentation

A practical walkthrough for deploying BunkerWeb with Docker and understanding the first screens you will see after installation.

Preparation (THM) Tryhackme Practical Walkthrough

Description : Understand the Preparation phase of the Incident Response lifecycle.

Designing an Isolated SOC Lab (Part 3): SIEM Engineering and Custom Data Parsing in Splunk

In the first two phases of this lab build, we engineered an isolated virtual network, deployed Suricata at the perimeter, and successfully…

Security Operations at Machine Speed: moving from Execution to Judgment

Security Operations at machine speed: moving from execution to judgment

How Context-Aware Investigations Are Reshaping Modern Security Operations

Discover how context-aware investigations help analysts understand incidents faster and respond with confidence.

Designing an Isolated SOC Lab (Part 2): Monitoring and Mitigating Networks with Suricata IPS

With our isolated network topology established and communication verified between our internal and external zones, the focus shifts…

Designing an Isolated SOC Lab (Part 1): Setting Up My Perimeter and SIEM

In cybersecurity operations, a massive gap exists between understanding a security tool conceptually and managing its behavior within a…

Traffic Analysis Pitfalls (THM) Tryhackme Walkthrough

Description : Learn about Visibility, Context, and Gaps in the traffic Analysis.

Obfuscated Lab — CyberDefenders

Objective: Deobfuscate multi-stage VBA and JavaScript malware from a Word document, extracting IOCs and reconstructing execution flow with…

Week 10: The Complete Guide to IP Addressing, Subnetting & DNS

Part of the Networking Series — if you missed Week 9, go check out OSI and TCP/IP models first!

How I Investigated a $47,000 Business Email Compromise Attack

TL;DR: As part of the CyBlack SOC Academy, my team and I investigated a 3-email Business Email Compromise campaign designed to steal…

How SIEM, XDR, and SOAR Converge in the SOC of 2026

There is a major shift happening within Security Operations Centers (SOCs). In today’s world where cyberattacks are constantly growing more…

Anatomy of MTTR: The Hidden Friction Slowing Security Investigations

Improving security operations starts with understanding where time is lost across the investigation lifecycle.​​​​‌

AI SOC Analyst NightShift LLM

I had a lingering question in my mind regarding how much a base AI model could be specialized in a specific domain through fine-tuning…

SOC Analisti Olmak İsteyenler İçin Kapsamlı Rehber: CIA Triad’dan Threat Hunting’e, Splunk ES’ten…

SOC Analisti Olmak İsteyenler İçin Kapsamlı Rehber: CIA Triad’dan Threat Hunting’e, Splunk ES’ten PEAK Framework’e

I Built a Phishing Lab to Finally Understand the Cyber Kill Chain

Mapping every stage of a phishing campaign to real telemetry, attacker actions, and SOC visibility

SOC Lab Rehberi Bölüm 5: Ubuntu Server Üzerine Wazuh Kurulumu

Bu bölümde, laboratuvarımızdaki tüm olayları (loglar, dosya bütünlüğü, zafiyetler) tek bir merkezden izlememizi sağlayacak olan Wazuh…