Skip to main content

#incident-response

Every article tagged “incident-response”, newest first.

Articles tagged incident-response

Stacked dark glass layers on a near-black background, with one thin amber line passing through them and lighting a point on each layer

Tutorials

Digital Forensics Tools: What a SOC Analyst Opens First

The digital forensics tools a SOC analyst opens first, checked November 2026: KAPE, Volatility 3, FTK Imager, Autopsy, plaso, Hayabusa, with commands.

Nerea Guallar18 min read
A stack of thin dark glass layers seen edge-on, with one amber line running down through a glowing node on every layer

Best Practices

Incident Response Plan Template Mapped to NIST SP 800-61r3

Copy this incident response plan template: roles and authority, severity levels, notification clocks and a checklist per phase, mapped to NIST SP 800-61r3.

Nerea Guallar16 min read
Abstract dark diagram of many dim branching paths with one amber route traced unbroken from left to right

Best Practices

SOC Playbook Template: Steps, Queries and Thresholds

Copy this SOC playbook template: triggers, steps, SPL/KQL/Lucene queries and branch thresholds for one alert type, with two filled-in examples.

Nicole Dobrovolskyy23 min read
Abstract dark chart of web request volume where one isolated bar is highlighted and branches into a small process tree

Tutorials

Web Shell Detection: KQL, IIS Logs and a 30-Minute Triage

The process-parent rule that finds web shells, the false positive that gets it muted, IIS log tells in KQL and Splunk, and an ordered first 30 minutes.

Astrid Lindqvist19 min read