Skip to main content

#threat-hunting

Every article tagged “threat-hunting”, newest first.

Articles tagged threat-hunting

A row of thin dark glass bars on a near-black background, with a few lit amber from inside and one glowing brightest

Tutorials

Sysmon Event IDs: All 30 Explained, and How to Turn Them On

All 30 Sysmon event IDs in v15.22: what each logs, its config tag, whether SwiftOnSecurity's config keeps it on, and the closest Security log event.

Nerea Guallar19 min read
Three panels of copper, a night-side Earth with city lights, and white marble above the words Now you can query.

Product Updates

Introducing the SOCSimulator Query Tab: Practice KQL in Your Browser

Practice KQL against the logs of a real operation: Windows, Linux and macOS data, nothing to set up. What it does and its limits.

Nicole Dobrovolskyy6 min read
Abstract dark chart of web request volume where one isolated bar is highlighted and branches into a small process tree

Tutorials

Web Shell Detection: KQL, IIS Logs and a 30-Minute Triage

The process-parent rule that finds web shells, the false positive that gets it muted, IIS log tells in KQL and Splunk, and an ordered first 30 minutes.

Astrid Lindqvist19 min read
Green Matrix-style falling code characters cascading down a pure black background, representing data stream analysis and threat hunting

Best Practices

Threat Hunting Tools: 13 Picks With Working Queries (2026)

Threat hunting tools by layer: Sigma, YARA, KQL, SPL, Velociraptor, Sysmon, Zeek and six more, rechecked October 2026, with working queries.

Astrid Lindqvist28 min read