Defensive Security

SOC operations, detection engineering, incident response, threat intelligence, and digital forensics.

Topics

Lessons

Detection rule authoring, SIGMA rules, false positive tuning

Disk, memory, network, and mobile forensics, chain of custody

Containment, eradication, recovery, post-mortem, IR playbooks

SIEM, alert triage, threat hunting, playbooks

MITRE ATT&CK, IOCs, TTP analysis, CTI platforms