Skip to main content
NG

Author

Nerea Guallar

Marketing, SOCSimulator

Nerea writes SOCSimulator's guides for people starting or growing a career in security operations: how Windows authentication shows up in the logs (NTLM vs Kerberos), and which tools a T1, T2 or T3 analyst opens first. Each guide is built around the questions a new analyst actually has on shift, with real event IDs and queries to practice on.

LinkedIn

Articles by Nerea Guallar

A row of thin dark glass bars on a near-black background, with a few lit amber from inside and one glowing brightest

Tutorials

Sysmon Event IDs: All 30 Explained, and How to Turn Them On

All 30 Sysmon event IDs in v15.22: what each logs, its config tag, whether SwiftOnSecurity's config keeps it on, and the closest Security log event.

Nerea Guallar19 min read
A stack of thin dark glass layers seen edge-on, with one amber line running down through a glowing node on every layer

Best Practices

Incident Response Plan Template Mapped to NIST SP 800-61r3

Copy this incident response plan template: roles and authority, severity levels, notification clocks and a checklist per phase, mapped to NIST SP 800-61r3.

Nerea Guallar16 min read
Four dark glass cubes linked on a faint grid, with one amber pulse travelling between them and an amber glow where it lands

Tutorials

Cybersecurity Home Lab: Build One That Generates Alerts

Build a cybersecurity home lab with Active Directory, Sysmon and a SIEM, then run 5 attacks and check the exact event IDs each one should leave.

Nerea Guallar13 min read
Abstract dark illustration of three stacked translucent layers with a single amber line passing down through each one

Best Practices

SOC Tools by Tier: What T1, T2 and T3 Analysts Open First

SOC tools sorted by tier and task, not category: what a T1 analyst opens in an alert's first 10 minutes, what T2 and T3 add, and what to practice free.

Nerea Guallar14 min read
Abstract dark data visualisation of two authentication paths running side by side, one traced in amber, converging on a single log entry

Tutorials

NTLM vs Kerberos: Differences and How to Read Them in Logs

NTLM vs Kerberos side by side, the 4624, 4776 and 4769 fields that show which one ran, why Windows falls back, and SPL and KQL that catch a downgrade.

Nerea Guallar20 min read