Learning, explained
Notes.
Notes from my cybersecurity learning and lab work, organised by topic.
SOC learning notes
Security operations · 6 articles
SOC learning notes
Security operations · 6 articles
Start with the definitions, then follow an alert into the evidence. Read in order or choose a topic below.
- 01
Foundations
Understanding the SOC environment
Start with the devices, data and security tools that make a SOC investigation possible.
- 02
SOC workflow
SOC operations and alert triage
How an alert moves from the queue to an investigation, a decision and a response.
- 03
Endpoint security
Endpoint threats and EDR
Common endpoint concepts and a simple investigation mindset: look beyond the alert’s severity or blocked status.
- 04
Guided lab notes
Following an EDR alert
Following a Mimikatz alert through process relationships, encoded PowerShell and supporting file analysis.
- 05
Log foundations
Understanding SIEM logs
From endpoint activity to searchable evidence: Windows Event Logs, Sysmon, parsing and KQL.
- 06
Guided lab notes
Investigating with Microsoft Sentinel
Pivot from an endpoint alert into the logs, narrow the search and follow related activity.
DFIR learning notes
Microsoft 365 BEC investigations · 6 articles
DFIR learning notes
Microsoft 365 BEC investigations · 6 articles
Understand the evidence, secure compromised access, and follow mailbox and file activity into an impact assessment. Read in order or choose a topic below.
- 01
Foundations
Understanding BEC and its evidence sources
Start with the incident questions, then understand which logs can help answer them.
- 02
Incident response
Containing compromised access
Secure the affected account and check the changes that could allow access to continue.
- 03
Access investigation
Finding suspicious access
Reduce a large set of events to useful leads, then compare them with the user’s normal activity.
- 04
Evidence correlation
Following sessions and building a timeline
Connect IP addresses and session identifiers to find related activity and reconstruct the sequence.
- 05
Data access
Investigating mailbox access
Understand which mail data may have been exposed and why Bind and Sync need different treatment.
- 06
Impact assessment
Assessing file access and business impact
Follow file and application activity, then explain the potential effect on information and the business.