Cyber Security
Security Operations
Monitoring, logging, detection and hardening in day-to-day security work.
- 10 notes
- 82 minutes of reading
- What a security operations centre doesWhat a security operations centre (SOC) is, the people, processes and technology inside it, how analyst tiers work, and how in-house, outsourced and hybrid SOC models compare. 7 min · Beginner
- SIEM and log management: collection, correlation and retentionHow a Security Information and Event Management (SIEM) platform collects, parses, normalises and correlates logs, how to plan retention, and how to build use cases that produce useful alerts. 8 min · Intermediate
- EDR and XDR: endpoint detection, response and host isolationWhat Endpoint Detection and Response (EDR) records on laptops and servers, how analysts use it to investigate and isolate hosts, and how Extended Detection and Response (XDR) widens the view. 7 min · Intermediate
- Alert triage: true and false positives, enrichment and escalationHow SOC analysts triage alerts: telling true from false positives, enriching with context, deciding when to escalate and writing notes that others can trust. 7 min · Beginner
- Detection engineering: writing, testing and mapping detectionsHow to design, write, test and maintain detection rules as code, map them to the MITRE framework of attacker techniques, and use the vendor-neutral Sigma format. 9 min · Advanced
- SOAR automation and SOC metrics: playbooks, MTTD, MTTR and wellbeingHow Security Orchestration, Automation and Response (SOAR) tools run playbooks, which SOC metrics such as MTTD and MTTR are worth tracking, and why analyst wellbeing is a security issue. 8 min · Intermediate
- SecOps explained: how security and IT operations work togetherWhat SecOps (security operations) means, how it differs from a SOC and from DevOps, the daily work it involves, the common challenges teams face and a practical order for building a programme. 8 min · Beginner
- Network security monitoring: packet captures, NetFlow and session dataThe kinds of data a SOC uses to watch a network, from full packet capture to NetFlow and IPFIX flow records, what each reveals, where to collect it, and how encryption changes what you can see. 9 min · Intermediate
- Threat hunting: hypothesis-driven searching for hidden attackersWhat threat hunting is, how it differs from alert-driven detection, the three main hunting approaches, a step-by-step hunting loop and how to turn every hunt into better detections. 9 min · Intermediate
- Log sources and log analysis: Windows, Linux, firewall and web logsWhich logs matter most for security monitoring, useful Windows event IDs and Linux log files, how to read firewall and web server logs, and a simple method for analysing logs during an investigation. 10 min · Intermediate