Security

Introduction For a SOC, using structured frameworks like MITRE ATT&CK enhances incident detection and provides a clear methodology for tracking and understanding adversarial behavior. This post will cover the basics of operationalizing MITRE ATT&CK in a SOC environment and handling high severity incidents (SEV0). We’ll explore how MITRE ATT&CK improves Read more

Introduction A well architected SIEM is one of the most valuable tools in a SOC, central to both detecting and responding to security incidents. This post will cover the essentials of setting up and configuring a SIEM, then move into effective log analysis techniques. For new analysts, this overview provides Read more

Introduction Starting out in a SOC requires a mix of technical and practical skills to handle a range of security incidents effectively. This post covers essential skills for SOC analysts, introduces core SOC playbooks, and explores basic automation within AWS environments. If you’re a new analyst, this guide will help Read more

Introduction In incident response, following a structured approach is fundamental to maintaining clarity, control, and precision. This post covers the essential concepts in incident handling, breaking down the life cycle stages and key operations within a SOC. Using NIST 800-61 as the primary guide, I’ll walk through the basics of Read more

The goal of detection engineering isn’t just to identify potential threats but to take meaningful action based on those findings. After documenting and analyzing your results, it is time to determine which findings require escalation, how to initiate an effective response, and how to use what you’ve learned to continuously Read more

As you analyze and interpret detection results, effective documentation becomes essential. Documentation provides a clear record of what has been observed, what steps have been taken, and where the investigation is headed. In this post, we’ll discuss how to document findings, organize investigation steps, and expand the investigation by connecting Read more

Creating detection analytics is only part of the equation in detection engineering. Once you have analytics in place, the next challenge is to interpret their results accurately, distinguishing genuine threats from benign anomalies. In this post, we’ll go through how to evaluate results, identify malicious activity amid outliers, and navigate Read more

In detection engineering, moving from a detection hypothesis to a working analytic is the heart of the process. It’s where ideas are transformed into rules that capture malicious behaviors in action. In this post, we’ll look at how to develop these analytics systematically, covering the essentials of transforming a hypothesis Read more

This is the first post in a series where I’ll cover detection engineering end to end. What is Detection Engineering? Detection engineering is a systematic approach to designing and refining analytics that detect specific malicious behaviors within a network. Unlike reactive incident response, detection engineering aims to create proactive detections Read more

Introduction Accurate, structured incident data is essential for effective analysis, reporting, and response. VERIS (Vocabulary for Event Recording and Incident Sharing) provides a standardized approach to categorize security incidents, improving insights and facilitating data sharing. By utilizing VERIS, organizations can leverage it in ServiceNow to gain both strategic and tactical Read more

Introduction KPIs are essential to aligning engineering team efforts with security goals and business objectives. In a metric driven security engineering environment, KPIs should be clear, actionable, and directly tied to team performance and productivity. The Role of KPIs in Security Engineering Core KPIs for Security Engineering Teams KPIs for Read more

Passkeys offer a passwordless and more secure way to authenticate to AWS accounts, reducing risks associated with credential-based attacks like phishing and password stuffing. Passkeys rely on cryptographic keys linked to users’ devices, making traditional passwords obsolete. This guide outlines the setup for passkeys in AWS IAM. What Are Passkeys? Read more

Identity and Access Management (IAM) is a critical cybersecurity frameworks which ensures that the right individuals and systems have appropriate access to an organization’s resources. In this post, I will break down IAM’s core concepts, explain its critical components, and provide technical examples of implementation. What is IAM? IAM refers Read more

Safeguarding sensitive company information and ensuring compliance is essential in this day and age. Microsoft Purview offers a robust solution for unified data governance, protection, and compliance management across your organization. Step 1: Access Microsoft Purview Portal Step 2: Create a Microsoft Purview Account in Azure Step 3: Set Up Read more

Overview For effective security management, you need visibility into your environment. SentinelOne offers powerful tools for auditing, reporting, and notifications that give you real-time insights, historical data, and alerts on critical events. Today, we’ll explore how to set up and customize these tools to maintain security oversight and ensure compliance. Read more

Overview Today, we’re exploring Advanced Detection Engines and Automation in SentinelOne. With advanced detection capabilities like Static and Behavioral AI, SentinelOne goes beyond traditional endpoint detection. Adding automation to these capabilities can help streamline responses and allow your team to focus on high-priority threats. Let’s break down how to configure Read more