Learning notes
The concepts behind the investigations.
Explore my SOC learning notes, from the basic definitions and alert triage to guided EDR and Microsoft Sentinel walkthroughs.
Read the SOC learning notes →My work
From alert to documented analysis.
I investigate security alerts and analyse logs, endpoint telemetry, and identity-based events to identify potential threats.
The work develops practical skills in security monitoring, alert triage, incident investigation, and digital forensics and incident response (DFIR).
Investigation approach
A repeatable path through an alert.
Validate
Confirm the alert, affected identity or endpoint, and data source.
Correlate
Build a timeline from sign-in, endpoint, and activity evidence.
Scope
Assess affected users, hosts, and actions, and record the limits of available evidence.
Document
Record the analysis, supporting evidence, limitations, and recommended next steps.