visitor@thefish.nz:~$ grep -r investigation

#investigation

One Alert Is Not the Incident: Scoping Security Incidents in the SOC 21 September 2026 soc incident-response investigation scoping threat-hunting dfir field-guide
Windows Event Logs for SOC Analysts: What an Event ID Actually Proves 20 September 2026 soc windows windows-event-logs investigation dfir detection field-guide
Threat Hunting for SOC Analysts: Turning a Suspicion Into a Searchable Hypothesis 20 September 2026 soc threat-hunting investigation detection-engineering siem splunk kql dfir field-guide
Ransomware Before the Ransomware: What the SOC Should See Before Encryption Starts 20 September 2026 soc ransomware incident-response investigation detection-engineering threat-actors qilin dfir field-guide
PowerShell Is Not the Alert: Investigating Living-off-the-Land Activity 20 September 2026 soc powershell lolbins windows investigation detection-engineering dfir field-guide
Identity Attacks for SOC Analysts: Sessions, Tokens, MFA and Account Compromise 20 September 2026 soc identity entra-id microsoft-365 account-compromise authentication incident-response investigation field-guide
How to Think Like a SOC Analyst in an Interview 20 September 2026 soc investigation interview incident-response analyst-methodology field-guide career
From Header to Host: Investigating Phishing in the SOC 20 September 2026 soc phishing email-security investigation identity incident-response dfir field-guide
Alert to Conclusion: Investigating Without Tunnel Vision 20 September 2026 soc investigation threat-hunting field-guide
OSINT Corroboration: How Do I Know I've Found the Right Person? 19 September 2026 osint investigation verification trace-labs field-guide
Social Media OSINT: From One Profile to a Digital Footprint 18 September 2026 osint social-media trace-labs investigation field-guide
Google Dorking for Trace Labs: 50 OSINT Investigation Pivots 17 September 2026 osint trace-labs google-dorking investigation research field-guide