30 practical guides
Blue Team
Defense Hub.
30 / 30 guides
Knowledge library
Built for decisions,
not decoration.
30 operational guides
SOC Operating Model
Design roles, queues, coverage, authority, and feedback loops for a sustainable security operations capability.
Alert Triage
Assess alert fidelity, scope, impact, and urgency without losing the evidence behind the decision.
Escalation & Communications
Escalate security events with the right urgency, audience, facts, and decision requests.
Threat Intelligence Enrichment
Use contextual intelligence to prioritize observations without treating reputation as proof of compromise.
Logging Strategy
Define security logging based on decisions, threats, data quality, privacy, retention, and cost.
SIEM Architecture
Design collection, normalization, storage, search, detection, and access boundaries for reliable security analytics.
Windows & Sysmon Telemetry
Collect high-value Windows activity with tuned Sysmon coverage and defensible retention.
Linux Audit Telemetry
Observe identity, privilege, process, service, and sensitive-file activity across Linux systems.
Network Detection with Zeek & Suricata
Combine network metadata and signatures to investigate behavior across monitored trust boundaries.
Cloud & SaaS Telemetry
Collect identity, control-plane, data-access, network, and workload evidence from cloud and SaaS services.
Sigma Detection Engineering
Write portable, testable behavior detections with explicit telemetry assumptions and response context.
Detection Lifecycle
Manage detection ideas from threat model through validation, deployment, monitoring, tuning, and retirement.
Incident Response Lifecycle
Integrate preparation, detection, response, recovery, and improvement with enterprise risk management.
Phishing Response
Analyze reported messages, protect identities, remove malicious content, and find related exposure.
Business Email Compromise
Contain compromised mail identities and fraudulent business workflows while preserving financial evidence.
Ransomware Response
Coordinate rapid containment, evidence preservation, business continuity, and clean recovery during ransomware events.
Endpoint Triage
Collect volatile and persistent endpoint context quickly while minimizing change to the system.
Memory Forensics
Use volatile-memory evidence to investigate processes, injected code, credentials exposure, and network activity.
Disk & Timeline Analysis
Reconstruct activity from file systems, logs, execution artifacts, and application history.
Containment, Eradication & Recovery
Choose proportionate containment, remove root causes, and restore services with verified security controls.
Hypothesis-Driven Threat Hunting
Turn threat models and environmental knowledge into falsifiable hunts with measurable outcomes.
Identity Threat Hunting
Hunt for suspicious authentication, privilege use, consent, session, and recovery behavior.
Endpoint Threat Hunting
Hunt for suspicious execution, persistence, credential access, defense changes, and lateral movement on endpoints.
Network Threat Hunting
Hunt for anomalous communication, tunneling, beaconing, lateral movement, and data movement.
Cloud Account Compromise Hunting
Hunt for stolen sessions, privilege escalation, persistence, and suspicious resource access in cloud environments.
EDR Operations
Operate endpoint prevention, detection, investigation, containment, and exception workflows safely at scale.
Vulnerability Management
Prioritize exposure by asset context, exploitability, control strength, and business consequence.
Email Security Engineering
Layer identity, authentication, content controls, user reporting, and response to reduce email-borne risk.
Segmentation & Firewall Review
Validate trust boundaries, allowed flows, rule ownership, logging, and exception expiry.
Backup, Recovery & Resilience
Protect backup systems and prove that critical services can be restored to a trustworthy state.