Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
The team that notices the 3am PowerShell reaching out to a sketchy IP and decides whether to wake someone up.
What a SOC Actually Does
The team that notices the 3am PowerShell reaching out to a sketchy IP and decides whether to wake someone up.
Alerts and Triage
Ninety percent of the queue is noise. Triage is how you find the one alert that is the fire, fast.
The MITRE ATT&CK Framework
A shared map of how attackers actually behave, so your alert stops being a mystery and becomes a labeled step in a known playbook.
Working a Shift
Queues, SLA clocks, and a handoff at the end. How a real eight hours in the SOC actually runs.
Escalation and Handoff
The difference between a smooth escalation and a dropped ball is one well-written paragraph.