Shahzaib Sajid·8h agoThe 60-70% False Positive Cut Wasn’t a Magic RuleWhat I learned about detection engineering after months of tuning SIEM alerts in an MSSP SOC
Mohan Krishna Reddy·22h agoA Recent Zero Day Vulnerability Experience and how we approached it….Lets get to the technicalities first,
Mohan Krishna Reddy·23h agoTOP 20 Detection Logics -SIEM BeginnerWhy I Wrote “Top 20 Detection Logics -Beginner Edition”
Akinola selim·1d agoSIEM Deployment Part 2: Adding Telemetry, Simulating Attacks and Performing Investigation in WazuhDuring the first part of this project, I set up my home lab and installed the Wazuh server and agents on my machines…
Victor Olawale·2d agoDetecting Lateral Movement in Windows Environments: Using Microsoft Defender, Sysmon, and KQL to…Compromising one computer does not always mean an attacker has achieved their objective.
InDetect FYIbyRcegan·2d agoImplementing Detection as Code as a multi-platform MSSPWhat was once considered to be a niche within a niche, Detection as Code has become a very popular method of managing detection rules…A response icon1A response icon1
Rick Martin·2d agoI Wanted to Catch Hackers. Two Years Later, I’m Building the Future of Detection EngineeringFrom writing detection rules to leading engineers, architecting AI-powered workflows, and making business decisions. Two years in…
Karanam Shrivasta·3d ago# Part 22 — Detection Rules & Detection Engineering*Fifteen medium-level interview questions on writing, structuring, testing, and maintaining detection rules — Sigma, YARA, network…
Ilja Krasnjanski·3d agoBuilding and Testing Detections for UNK_DeadDropThirty-three YARA rules replayed against retained artifacts, followed by a separate noise review and static scanner evaluation.
Vaasudev·3d agoBuilding a Detection-as-Code Pipeline for Microsoft Sentinel (Part 3): Native Sentinel Repositories…In the first two parts of this series, I built a custom Detection-as-Code pipeline for Microsoft Sentinel.
