Security Insights
Research, tutorials, and analysis to help you become a more effective security analyst.
Latest
Tutorials
Sysmon Event IDs: All 30 Explained, and How to Turn Them On
All 30 Sysmon event IDs in v15.22: what each logs, its config tag, whether SwiftOnSecurity's config keeps it on, and the closest Security log event.
Best Practices
Incident Response Plan Template Mapped to NIST SP 800-61r3
Copy this incident response plan template: roles and authority, severity levels, notification clocks and a checklist per phase, mapped to NIST SP 800-61r3.
Best Practices
VirusTotal Alternatives: Check a File Without Uploading It
VirusTotal alternatives sorted by what they need from you: hash-only lookups, public sandboxes that publish your upload, and self-hosted tools.
More articles
Page 1 of 4
Tutorials
Cybersecurity Home Lab: Build One That Generates Alerts
Build a cybersecurity home lab with Active Directory, Sysmon and a SIEM, then run 5 attacks and check the exact event IDs each one should leave.
Nerea Guallar13 min read
Best Practices
EDR vs Antivirus vs XDR: Key Differences for SOC Analysts
EDR vs antivirus vs XDR: what each one blocks and records, whether XDR is better than antivirus, and what SOC analysts can conclude from each alert.
Nicole Dobrovolskyy8 min read
Best Practices
SOC Tools by Tier: What T1, T2 and T3 Analysts Open First
SOC tools sorted by tier and task, not category: what a T1 analyst opens in an alert's first 10 minutes, what T2 and T3 add, and what to practice free.
Nerea Guallar14 min read
Tutorials
NTLM vs Kerberos: Differences and How to Read Them in Logs
NTLM vs Kerberos side by side, the 4624, 4776 and 4769 fields that show which one ran, why Windows falls back, and SPL and KQL that catch a downgrade.
Nerea Guallar20 min read
Best Practices
SOC Playbook Template: Steps, Queries and Thresholds
Copy this SOC playbook template: triggers, steps, SPL/KQL/Lucene queries and branch thresholds for one alert type, with two filled-in examples.
Nicole Dobrovolskyy23 min read
Tutorials
Web Shell Detection: KQL, IIS Logs and a 30-Minute Triage
The process-parent rule that finds web shells, the false positive that gets it muted, IIS log tells in KQL and Splunk, and an ordered first 30 minutes.
Astrid Lindqvist19 min read