Skip to main content

Best Practices

Practical techniques for SOC analysts: triage habits, detection engineering, and the daily workflows that separate good analysts from great ones.

A stack of thin dark glass layers seen edge-on, with one amber line running down through a glowing node on every layer

Best Practices

Incident Response Plan Template Mapped to NIST SP 800-61r3

Copy this incident response plan template: roles and authority, severity levels, notification clocks and a checklist per phase, mapped to NIST SP 800-61r3.

Nerea Guallar16 min read

Latest

More articles

Page 1 of 2

Abstract dark illustration of three stacked translucent layers with a single amber line passing down through each one

Best Practices

SOC Tools by Tier: What T1, T2 and T3 Analysts Open First

SOC tools sorted by tier and task, not category: what a T1 analyst opens in an alert's first 10 minutes, what T2 and T3 add, and what to practice free.

Nerea Guallar14 min read
Abstract dark diagram of many dim branching paths with one amber route traced unbroken from left to right

Best Practices

SOC Playbook Template: Steps, Queries and Thresholds

Copy this SOC playbook template: triggers, steps, SPL/KQL/Lucene queries and branch thresholds for one alert type, with two filled-in examples.

Nicole Dobrovolskyy23 min read
Dual-monitor workstation in a dark room showing code on an iMac and a landscape wallpaper on a second display, lit by a desk lamp

Best Practices

Best EDR Tools in 2026: What Each Console Shows You

Eight EDR tools compared on what each console shows an analyst, with plan names, public prices checked October 2026, and free and open source options.

Astrid Lindqvist21 min read
Green Matrix-style falling code characters cascading down a pure black background, representing data stream analysis and threat hunting

Best Practices

Threat Hunting Tools: 13 Picks With Working Queries (2026)

Threat hunting tools by layer: Sigma, YARA, KQL, SPL, Velociraptor, Sysmon, Zeek and six more, rechecked October 2026, with working queries.

Astrid Lindqvist28 min read
Dark analytics dashboard on a tablet screen displaying colorful performance charts and session metrics against a black background

Best Practices

Best SIEM Tools in 2026: 12 Platforms Ranked

12 best SIEM tools for 2026, re-checked in September: Splunk under Cisco, QRadar SaaS moved to Cortex XSIAM, pricing models, and who each one fits.

Astrid Lindqvist26 min read
MacBook Pro on a dark desk with a colorful code editor open showing syntax-highlighted source code in a dark theme

Best Practices

Open Source SIEM: 7 Free Tools for Your Home Lab (2026)

Open source SIEM tools to self-host on Linux with Docker: Wazuh, OpenSearch and 5 more, with RAM specs and which licenses are truly open source.

Astrid Lindqvist20 min read