Author
Astrid Lindqvist
Content Strategist, SOCSimulator
Astrid is the Content Strategist at SOCSimulator, where she shapes the detection scenarios, attack narratives, and learning paths analysts train against. She comes from a blue-team background, with years spent close to live SOC operations, triaging alerts and tuning detections, and now turns that reality into structured, hands-on training. She writes about the craft of detection and response, and the human side of working a SOC shift.
Articles by Astrid Lindqvist
Tutorials
Web Shell Detection: KQL, IIS Logs and a 30-Minute Triage
The process-parent rule that finds web shells, the false positive that gets it muted, IIS log tells in KQL and Splunk, and an ordered first 30 minutes.
Astrid Lindqvist19 min read
Tutorials
Windows Logon Types: A Triage Guide for Every 4624 Value
Every Windows logon type, what produces it in a healthy environment, what it means when it appears where it should not, and the queries to hunt it.
Astrid Lindqvist17 min read
Tutorials
Device Code Phishing: How to Detect the MFA Bypass
Device code phishing gives attackers OAuth tokens after the victim passes real MFA. See the Entra sign-in signals that catch it and how to block the flow.
Astrid Lindqvist11 min read
Tutorials
Redline Stealer Detection: SOC Analyst Checklist
Detect Redline Stealer by its traces: non-browser reads of Login Data, reflective .NET loads, screen capture calls, SOAP C2 traffic, then a 6-step triage.
Astrid Lindqvist14 min read
Tutorials
Kusto Query Language (KQL): A SOC Analyst's Practical Tutorial
Kusto Query Language (KQL) is how you query Microsoft Sentinel and Defender XDR logs. Learn to read a KQL query, write one, and run two real triage examples.
Astrid Lindqvist17 min read
Tutorials
Sigma Rules Explained: Read, Write, and Convert One
Sigma rules are vendor-agnostic YAML detections. Read one rule field by field, then see its real sigma-cli output in Splunk SPL and Microsoft Sentinel KQL.
Astrid Lindqvist16 min read
Tutorials
Windows Event Logs: Where They Live and How to Read Them
Windows event logs are .evtx files in C:\Windows\System32\winevt\Logs. Read the channels that matter to a SOC and preserve a copy as evidence.
Astrid Lindqvist20 min read
Tutorials
MITRE ATT&CK for SOC Analysts: Tactics, IDs, Examples
All 15 Enterprise tactic IDs (Lateral Movement is TA0008), how techniques nest under them, and a worked alert chain mapped to ATT&CK step by step.
Astrid Lindqvist24 min read
Tutorials
Phishing Email Examples: 15 Analyzed by a SOC Analyst
Phishing email examples analyzed with real analyst eyes: red flags, header tells, and the patterns every security-aware person should recognize.
Astrid Lindqvist23 min read
Best Practices
Best EDR Tools in 2026: What Each Console Shows You
Eight EDR tools compared on what each console shows an analyst, with plan names, public prices checked October 2026, and free and open source options.
Astrid Lindqvist21 min read
Best Practices
Threat Hunting Tools: 13 Picks With Working Queries (2026)
Threat hunting tools by layer: Sigma, YARA, KQL, SPL, Velociraptor, Sysmon, Zeek and six more, rechecked October 2026, with working queries.
Astrid Lindqvist28 min read
Tutorials
SIEM Use Cases: 10 Every SOC Runs (With Detection Logic)
SIEM use cases explained with detection logic sketches, data sources, and tuning notes for the 10 detections every SOC team operates.
Astrid Lindqvist18 min read
Best Practices
Best SIEM Tools in 2026: 12 Platforms Ranked
12 best SIEM tools for 2026, re-checked in September: Splunk under Cisco, QRadar SaaS moved to Cortex XSIAM, pricing models, and who each one fits.
Astrid Lindqvist26 min read
Best Practices
Open Source SIEM: 7 Free Tools for Your Home Lab (2026)
Open source SIEM tools to self-host on Linux with Docker: Wazuh, OpenSearch and 5 more, with RAM specs and which licenses are truly open source.
Astrid Lindqvist20 min read
Best Practices
Best Cybersecurity Certifications for Beginners (2026)
Best cybersecurity certifications for beginners in 2026, ranked by ROI for SOC-bound career switchers. Honest costs, HR recognition, and skill signal per cert.
Astrid Lindqvist19 min read
Tutorials
Windows Event IDs & Codes Cheat Sheet: The 31 That Matter
The 31 Windows event IDs and codes SOC analysts triage most: logon, Kerberos, process, services, Sysmon, log clearing, plus detection pages for 12 of them.
Astrid Lindqvist18 min read
Tutorials
Common Port Numbers Cheat Sheet: 42 Ports for SOC Triage
The 42 TCP/UDP port numbers SOC analysts read in firewall logs and SIEM alerts, what each one means in triage, and a printable cheat sheet image to save.
Astrid Lindqvist21 min read
Tutorials
How to Analyze a Phishing Email: SOC Walkthrough
A step-by-step SOC workflow to analyze a phishing email: safe handling, header forensics, URL and attachment triage, and a documented verdict.
Astrid Lindqvist18 min read
Tutorials
Alert Triage: Real Threats vs False Positives
Alert triage is the core SOC skill. Learn the framework analysts use to assess severity, confirm IOCs, and separate real threats from false positives.
Astrid Lindqvist14 min read
Best Practices
SOC Analyst Interview Questions: 30 With Answers
SOC analyst interview questions decoded: what interviewers test, sample answers, and log examples to study before your first security ops interview.
Astrid Lindqvist19 min read
Best Practices
SOC Analyst Salary 2026: Tier 1 to Tier 3 ($48K to $145K)
Tier 1 SOC analysts earn $48,000 to $72,000; Tier 3 and leads reach $145,000. Honest ranges by tier, location, and cert, from BLS and aggregator data.
Astrid Lindqvist18 min read
Best Practices
How to Become a SOC Analyst (With or Without a Degree)
How to become a SOC analyst: a realistic roadmap from IT helpdesk to SOC, covering certs, hands-on practice, and what hiring managers actually screen for.
Astrid Lindqvist14 min read
Best Practices
What Does a SOC Analyst Do? The Role, Explained by Tier
What does a SOC analyst do? A tier-by-tier breakdown of the role, a realistic daily shift, tools, skills, and common myths, for career switchers.
Astrid Lindqvist18 min read