Skip to main content

#soc

Every article tagged “soc”, newest first.

Articles tagged soc

A row of thin dark glass bars on a near-black background, with a few lit amber from inside and one glowing brightest

Tutorials

Sysmon Event IDs: All 30 Explained, and How to Turn Them On

All 30 Sysmon event IDs in v15.22: what each logs, its config tag, whether SwiftOnSecurity's config keeps it on, and the closest Security log event.

Nerea Guallar19 min read
A stack of thin dark glass layers seen edge-on, with one amber line running down through a glowing node on every layer

Best Practices

Incident Response Plan Template Mapped to NIST SP 800-61r3

Copy this incident response plan template: roles and authority, severity levels, notification clocks and a checklist per phase, mapped to NIST SP 800-61r3.

Nerea Guallar16 min read
A sealed dark glass cube behind a translucent wall, with one thin amber thread passing through to light up a few dots on a grid

Best Practices

VirusTotal Alternatives: Check a File Without Uploading It

VirusTotal alternatives sorted by what they need from you: hash-only lookups, public sandboxes that publish your upload, and self-hosted tools.

Nicole Dobrovolskyy15 min read
Person at a MacBook Pro with a messaging app open in a cafe, simultaneously scrolling on a smartphone, iced drink on the table

Tutorials

Phishing Email Examples: 15 Analyzed by a SOC Analyst

Phishing email examples analyzed with real analyst eyes: red flags, header tells, and the patterns every security-aware person should recognize.

Astrid Lindqvist23 min read
Dual-monitor workstation in a dark room showing code on an iMac and a landscape wallpaper on a second display, lit by a desk lamp

Best Practices

Best EDR Tools in 2026: What Each Console Shows You

Eight EDR tools compared on what each console shows an analyst, with plan names, public prices checked October 2026, and free and open source options.

Astrid Lindqvist21 min read
Green Matrix-style falling code characters cascading down a pure black background, representing data stream analysis and threat hunting

Best Practices

Threat Hunting Tools: 13 Picks With Working Queries (2026)

Threat hunting tools by layer: Sigma, YARA, KQL, SPL, Velociraptor, Sysmon, Zeek and six more, rechecked October 2026, with working queries.

Astrid Lindqvist28 min read
Dark analytics dashboard on a tablet screen displaying colorful performance charts and session metrics against a black background

Best Practices

Best SIEM Tools in 2026: 12 Platforms Ranked

12 best SIEM tools for 2026, re-checked in September: Splunk under Cisco, QRadar SaaS moved to Cortex XSIAM, pricing models, and who each one fits.

Astrid Lindqvist26 min read
Hand holding a blue pen writing notes on paper at a wooden desk with a coffee mug and notebook beside it

Best Practices

Best Cybersecurity Certifications for Beginners (2026)

Best cybersecurity certifications for beginners in 2026, ranked by ROI for SOC-bound career switchers. Honest costs, HR recognition, and skill signal per cert.

Astrid Lindqvist19 min read
Network traffic analysis dashboard showing TCP and UDP port connections, firewall logs, and protocol distribution for SOC triage

Tutorials

Common Port Numbers Cheat Sheet: 42 Ports for SOC Triage

The 42 TCP/UDP port numbers SOC analysts read in firewall logs and SIEM alerts, what each one means in triage, and a printable cheat sheet image to save.

Astrid Lindqvist21 min read