Skip to main content

#blue-team

Every article tagged “blue-team”, newest first.

Articles tagged blue-team

Abstract rows of dark ridged slats curving across a black background, lit by a warm orange glow, evoking parallel paths fanning out from one source

Tutorials

Sigma Rules Explained: Read, Write, and Convert One

Sigma rules are vendor-agnostic YAML detections. Read one rule field by field, then see its real sigma-cli output in Splunk SPL and Microsoft Sentinel KQL.

Astrid Lindqvist16 min read
Abstract rows of dark glass slats receding diagonally with a warm orange glow, evoking scrolling log lines

Tutorials

Windows Event Logs: Where They Live and How to Read Them

Windows event logs are .evtx files in C:\Windows\System32\winevt\Logs. Read the channels that matter to a SOC and preserve a copy as evidence.

Astrid Lindqvist20 min read
Person at a MacBook Pro with a messaging app open in a cafe, simultaneously scrolling on a smartphone, iced drink on the table

Tutorials

Phishing Email Examples: 15 Analyzed by a SOC Analyst

Phishing email examples analyzed with real analyst eyes: red flags, header tells, and the patterns every security-aware person should recognize.

Astrid Lindqvist23 min read
Dual-monitor workstation in a dark room showing code on an iMac and a landscape wallpaper on a second display, lit by a desk lamp

Best Practices

Best EDR Tools in 2026: What Each Console Shows You

Eight EDR tools compared on what each console shows an analyst, with plan names, public prices checked October 2026, and free and open source options.

Astrid Lindqvist21 min read
Green Matrix-style falling code characters cascading down a pure black background, representing data stream analysis and threat hunting

Best Practices

Threat Hunting Tools: 13 Picks With Working Queries (2026)

Threat hunting tools by layer: Sigma, YARA, KQL, SPL, Velociraptor, Sysmon, Zeek and six more, rechecked October 2026, with working queries.

Astrid Lindqvist28 min read
Silhouetted figures standing inside a dark immersive installation with cascading blue-white data lights falling like rain around them

Tutorials

SIEM Use Cases: 10 Every SOC Runs (With Detection Logic)

SIEM use cases explained with detection logic sketches, data sources, and tuning notes for the 10 detections every SOC team operates.

Astrid Lindqvist18 min read
Dark analytics dashboard on a tablet screen displaying colorful performance charts and session metrics against a black background

Best Practices

Best SIEM Tools in 2026: 12 Platforms Ranked

12 best SIEM tools for 2026, re-checked in September: Splunk under Cisco, QRadar SaaS moved to Cortex XSIAM, pricing models, and who each one fits.

Astrid Lindqvist26 min read
MacBook Pro on a dark desk with a colorful code editor open showing syntax-highlighted source code in a dark theme

Best Practices

Open Source SIEM: 7 Free Tools for Your Home Lab (2026)

Open source SIEM tools to self-host on Linux with Docker: Wazuh, OpenSearch and 5 more, with RAM specs and which licenses are truly open source.

Astrid Lindqvist20 min read
Hand holding a blue pen writing notes on paper at a wooden desk with a coffee mug and notebook beside it

Best Practices

Best Cybersecurity Certifications for Beginners (2026)

Best cybersecurity certifications for beginners in 2026, ranked by ROI for SOC-bound career switchers. Honest costs, HR recognition, and skill signal per cert.

Astrid Lindqvist19 min read