Skip to main content

Security Insights

Research, tutorials, and analysis to help you become a more effective security analyst.

Latest Articles

Abstract dark grid of glass panels receding into shadow, lit by a warm orange glow, evoking the MITRE ATT&CK matrix
Tutorials

MITRE ATT&CK Explained: A SOC Analyst's Field Guide

What MITRE ATT&CK actually is, how tactics and techniques work together, and how tier-1 analysts use the framework to triage alerts and find gaps.

Astrid LindqvistJul 16, 202622 min read

Person at a MacBook Pro with a messaging app open in a cafe, simultaneously scrolling on a smartphone, iced drink on the table
Tutorials

Phishing Email Examples: 15 Analyzed by a SOC Analyst

Phishing email examples analyzed with real analyst eyes: red flags, header tells, and the patterns every security-aware person should recognize.

Astrid LindqvistJun 10, 202622 min read

Dual-monitor workstation in a dark room showing code on an iMac and a landscape wallpaper on a second display, lit by a desk lamp
Best Practices

Best EDR Tools in 2026: What Tier 1 Analysts Learn First

Best EDR tools for SOC analysts: CrowdStrike, Defender, SentinelOne, Cortex XDR and more — ranked by console learnability and job-market frequency.

Astrid LindqvistJun 6, 202617 min read

Green Matrix-style falling code characters cascading down a pure black background, representing data stream analysis and threat hunting
Best Practices

Cyber Threat Hunting Tools: 13 SOC Analysts Use (2026)

Cyber threat hunting tools every SOC analyst needs: Sigma, YARA, KQL, Velociraptor, Wireshark, Zeek, MISP and more — grouped by layer with code examples.

Astrid LindqvistJun 3, 202618 min read

Silhouetted figures standing inside a dark immersive installation with cascading blue-white data lights falling like rain around them
Tutorials

SIEM Use Cases: 10 Every SOC Runs (With Detection Logic)

SIEM use cases explained with detection logic sketches, data sources, and tuning notes for the 10 detections every SOC team operates.

Astrid LindqvistMay 31, 202617 min read

Dark analytics dashboard on a tablet screen displaying colorful performance charts and session metrics against a black background
Best Practices

Best SIEM Tools in 2026: 10 Platforms Ranked

Best SIEM tools ranked for 2026: Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security, and more — reviewed from a SOC analyst training perspective.

Astrid LindqvistMay 28, 202619 min read

MacBook Pro on a dark desk with a colorful code editor open showing syntax-highlighted source code in a dark theme
Best Practices

Open Source SIEM Tools: 7 for Your Home Lab (2026)

Open source SIEM tools let you build real detection skills at zero cost. Here are 7 worth running in a home lab, ranked by what they actually teach.

Astrid LindqvistMay 23, 202616 min read

Hand holding a blue pen writing notes on paper at a wooden desk with a coffee mug and notebook beside it
Best Practices

Best Cybersecurity Certifications for Beginners (2026)

Best cybersecurity certifications for beginners in 2026, ranked by ROI for SOC-bound career switchers. Honest costs, HR recognition, and skill signal per cert.

Astrid LindqvistMay 21, 202615 min read

Windows Security event log entries displayed in a SIEM console, showing event IDs for authentication and process activity
Tutorials

Windows Event IDs Cheat Sheet: The 31 That Matter

Windows event IDs cheat sheet for SOC analysts: 31 essential security event IDs covering auth, process execution, log tampering, and lateral movement.

Astrid LindqvistMay 14, 202616 min read