visitor@thefish.nz:~$ grep -r soc

#soc

One Alert Is Not the Incident: Scoping Security Incidents in the SOC 21 September 2026 soc incident-response investigation scoping threat-hunting dfir field-guide
Windows Event Logs for SOC Analysts: What an Event ID Actually Proves 20 September 2026 soc windows windows-event-logs investigation dfir detection field-guide
Threat Hunting for SOC Analysts: Turning a Suspicion Into a Searchable Hypothesis 20 September 2026 soc threat-hunting investigation detection-engineering siem splunk kql dfir field-guide
SPF, DKIM and DMARC: What They Actually Prove (and What They Don't) 20 September 2026 email-security phishing spf dkim dmarc soc dfir field-guide
Ransomware Before the Ransomware: What the SOC Should See Before Encryption Starts 20 September 2026 soc ransomware incident-response investigation detection-engineering threat-actors qilin dfir field-guide
PowerShell Is Not the Alert: Investigating Living-off-the-Land Activity 20 September 2026 soc powershell lolbins windows investigation detection-engineering dfir field-guide
The IP Isn't the Attacker: A SOC Analyst's Guide to NAT, VPNs and Proxies 20 September 2026 soc blue-team networking field-guide skills
Identity Attacks for SOC Analysts: Sessions, Tokens, MFA and Account Compromise 20 September 2026 soc identity entra-id microsoft-365 account-compromise authentication incident-response investigation field-guide
How to Think Like a SOC Analyst in an Interview 20 September 2026 soc investigation interview incident-response analyst-methodology field-guide career
From Header to Host: Investigating Phishing in the SOC 20 September 2026 soc phishing email-security investigation identity incident-response dfir field-guide
Alert to Conclusion: Investigating Without Tunnel Vision 20 September 2026 soc investigation threat-hunting field-guide