Security Insights
Research, tutorials, and analysis to help you become a more effective security analyst.
Latest
Best Practices
EDR vs Antivirus vs XDR: Key Differences for SOC Analysts
EDR vs antivirus vs XDR: compare prevention, endpoint investigation and cross-domain data. See how SOC analysts read alerts and practice in simulations.
Best Practices
SOC Tools by Tier: What T1, T2 and T3 Analysts Open First
SOC tools sorted by tier and task, not category: what a T1 analyst opens in an alert's first 10 minutes, what T2 and T3 add, and what to practice free.
Tutorials
NTLM vs Kerberos: Differences and How to Read Them in Logs
NTLM vs Kerberos side by side, the 4624, 4776 and 4769 fields that show which one ran, why Windows falls back, and SPL and KQL that catch a downgrade.
More articles
Page 1 of 3
Best Practices
SOC Playbook Template: Steps, Queries and Thresholds
Copy this SOC playbook template: triggers, steps, SPL/KQL/Lucene queries and branch thresholds for one alert type, with two filled-in examples.
Nicole Dobrovolskyy23 min read
Tutorials
Web Shell Detection: KQL, IIS Logs and a 30-Minute Triage
The process-parent rule that finds web shells, the false positive that gets it muted, IIS log tells in KQL and Splunk, and an ordered first 30 minutes.
Astrid Lindqvist18 min read
Tutorials
Windows Logon Types: A Triage Guide for Every 4624 Value
Every Windows logon type, what produces it in a healthy environment, what it means when it appears where it should not, and the queries to hunt it.
Astrid Lindqvist17 min read
Tutorials
Device Code Phishing: How OAuth Token Theft Bypasses MFA (and How to Detect It)
Device code phishing steals OAuth tokens after the victim passes MFA. Learn how the attack works and the Entra log signals that expose it.
Astrid Lindqvist11 min read
Tutorials
Redline Stealer Analysis: How Infostealers Work and How to Detect Them
Redline Stealer is a malware-as-a-service infostealer that steals credentials, tokens, clipboard data, and screenshots. Learn to detect and triage it.
Astrid Lindqvist13 min read
Tutorials
Kusto Query Language (KQL): A SOC Analyst's Practical Tutorial
Kusto Query Language (KQL) is how you query Microsoft Sentinel and Defender XDR logs. Learn to read a KQL query, write one, and run two real triage examples.
Astrid Lindqvist16 min read