Skip to main content
NG

Author

Nerea Guallar

Marketing, SOCSimulator

Nerea writes SOCSimulator's guides for people starting or growing a career in security operations: how Windows authentication shows up in the logs (NTLM vs Kerberos), and which tools a T1, T2 or T3 analyst opens first. Each guide is built around the questions a new analyst actually has on shift, with real event IDs and queries to practice on.

LinkedIn

Articles by Nerea Guallar

Four dark glass cubes linked on a faint grid, with one amber pulse travelling between them and an amber glow where it lands

Tutorials

Cybersecurity Home Lab: Build One That Generates Alerts

Build a cybersecurity home lab with Active Directory, Sysmon and a SIEM, then run 5 attacks and check the exact event IDs each one should leave.

Nerea Guallar13 min read
Abstract dark illustration of three stacked translucent layers with a single amber line passing down through each one

Best Practices

SOC Tools by Tier: What T1, T2 and T3 Analysts Open First

SOC tools sorted by tier and task, not category: what a T1 analyst opens in an alert's first 10 minutes, what T2 and T3 add, and what to practice free.

Nerea Guallar14 min read
Abstract dark data visualisation of two authentication paths running side by side, one traced in amber, converging on a single log entry

Tutorials

NTLM vs Kerberos: Differences and How to Read Them in Logs

NTLM vs Kerberos side by side, the 4624, 4776 and 4769 fields that show which one ran, why Windows falls back, and SPL and KQL that catch a downgrade.

Nerea Guallar20 min read