Anouar RIYANE·5d agoInvestigating PHP2Shell: A SOC Analyst’s Journey from Apache Logs to Remote Code ExecutionWhen I started the dOOMs Day Sherlock, I had three useful sources of evidence: an Apache access log, an Apache error log, and a packet…
InfosecPandey·Oct 12Investigating a Phishing Incident in Microsoft SentinelA SOC Analyst’s Investigation Story
Ahmed Yasser·Sep 26Building a SOC Home Lab with Wazuh, Suricata, and Sysmon: From Attack Simulation to Incident…Introduction
Muhammad Usman·Sep 6Building a Centralized SOC Lab: Integrating Wazuh SIEM Telemetry with Graylog via Filebeat & DockerA step-by-step operational guide to forwarding endpoint security events from a Wazuh Manager VM to Graylog running on Windows using WSL2…
Sodiq Muftau·Sep 4Splunk BOTS v1: Following an Attack from Reconnaissance to Cerber Ransomware.I recently worked through the Splunk Boss of the SOC (BOTS) v1 dataset as a practical way of testing my investigation skills across…
Denysqw·Jul 23How to Explain the Same Security Incident to Three Different AudiencesI’ve often heard cybersecurity professionals talk about the importance of understanding the technical background of the people you…
Meera Tamboli·Jul 22Death of the Security AnalystI attended Infosecurity Europe 2026 a few weeks ago.
Ashwin Govind·Jul 3SIEM vs EDR vs XDR — Simply Explained for SOC AnalystsWhen I joined the SOC, these three acronyms stood out in almost every conversation:
Ashwanth D·May 15Getting Started with SPL (Search Processing Language) in SplunkDuring my SOC internship, one of the tasks I worked on was exploring the basics of SPL (Search Processing Language) inside Splunk…
