Skip to main content
Back to all posts
Tag

#detection

Dark analytics dashboard on a tablet screen displaying colorful performance charts and session metrics against a black background
Best Practices

Best SIEM Tools in 2026: 12 Platforms Ranked

12 best SIEM tools for 2026, re-checked in September: Splunk under Cisco, QRadar SaaS moved to Cortex XSIAM, pricing models, and who each one fits.

Astrid LindqvistMay 28, 202626 min read

MacBook Pro on a dark desk with a colorful code editor open showing syntax-highlighted source code in a dark theme
Best Practices

Open Source SIEM: 7 Free Tools for Your Home Lab (2026)

Open source SIEM tools to self-host on Linux with Docker: Wazuh, OpenSearch and 5 more, with RAM specs and which licenses are truly open source.

Astrid LindqvistMay 23, 202620 min read

Windows Security event log entries displayed in a SIEM console, showing event IDs for authentication and process activity
Tutorials

Windows Event IDs & Codes Cheat Sheet: The 31 That Matter

The 31 Windows event IDs and codes SOC analysts triage most: logon, Kerberos, process, services, Sysmon, log clearing, plus detection pages for 12 of them.

Astrid LindqvistMay 14, 202617 min read

Network traffic analysis dashboard showing TCP and UDP port connections, firewall logs, and protocol distribution for SOC triage
Tutorials

Common Port Numbers Cheat Sheet: 42 Ports for SOC Triage

The 42 TCP/UDP port numbers SOC analysts read in firewall logs and SIEM alerts, what each one means in triage, and a printable cheat sheet image to save.

Astrid LindqvistMay 11, 202621 min read

Close-up of a dark SIEM dashboard on a widescreen monitor, rows of alerts highlighted in orange, gloved hands at the keyboard
Tutorials

Alert Triage: Real Threats vs False Positives

Alert triage is the core SOC skill. Learn the framework analysts use to assess severity, confirm IOCs, and separate real threats from false positives.

Astrid LindqvistApr 29, 202613 min read