Skip to main content

Tutorials

Step-by-step tutorials for SOC analysts: log analysis, KQL and Sigma, SIEM and XDR investigation, and hands-on alert triage you can practice on SOCSimulator.

A row of thin dark glass bars on a near-black background, with a few lit amber from inside and one glowing brightest

Tutorials

Sysmon Event IDs: All 30 Explained, and How to Turn Them On

All 30 Sysmon event IDs in v15.22: what each logs, its config tag, whether SwiftOnSecurity's config keeps it on, and the closest Security log event.

Nerea Guallar19 min read

Latest

More articles

Page 1 of 2

Abstract dark chart of web request volume where one isolated bar is highlighted and branches into a small process tree

Tutorials

Web Shell Detection: KQL, IIS Logs and a 30-Minute Triage

The process-parent rule that finds web shells, the false positive that gets it muted, IIS log tells in KQL and Splunk, and an ordered first 30 minutes.

Astrid Lindqvist19 min read
Abstract dark illustration of numbered authentication paths converging on a single Windows security log entry

Tutorials

Windows Logon Types: A Triage Guide for Every 4624 Value

Every Windows logon type, what produces it in a healthy environment, what it means when it appears where it should not, and the queries to hunt it.

Astrid Lindqvist17 min read
Abstract dark illustration of a glowing authentication code fracturing into token shards drifting toward a shadowed terminal

Tutorials

Device Code Phishing: How to Detect the MFA Bypass

Device code phishing gives attackers OAuth tokens after the victim passes real MFA. See the Entra sign-in signals that catch it and how to block the flow.

Astrid Lindqvist11 min read
Abstract dark illustration of a shattered screen with glowing amber binary code bursting through it

Tutorials

Redline Stealer Detection: SOC Analyst Checklist

Detect Redline Stealer by its traces: non-browser reads of Login Data, reflective .NET loads, screen capture calls, SOAP C2 traffic, then a 6-step triage.

Astrid Lindqvist14 min read
Abstract layered rows of translucent amber panels flowing left to right against a dark background, suggesting data moving through sequential stages

Tutorials

Kusto Query Language (KQL): A SOC Analyst's Practical Tutorial

Kusto Query Language (KQL) is how you query Microsoft Sentinel and Defender XDR logs. Learn to read a KQL query, write one, and run two real triage examples.

Astrid Lindqvist17 min read
Abstract rows of dark ridged slats curving across a black background, lit by a warm orange glow, evoking parallel paths fanning out from one source

Tutorials

Sigma Rules Explained: Read, Write, and Convert One

Sigma rules are vendor-agnostic YAML detections. Read one rule field by field, then see its real sigma-cli output in Splunk SPL and Microsoft Sentinel KQL.

Astrid Lindqvist16 min read