Blog
Threat hunting and detection engineering, written down: the reporting behind rules, the telemetry that feeds them, and the gaps that get attackers through.
3 articles
Guides & TutorialsWhat Is a SOC Runbook?
Step 4 of a log source onboarding runbook is one command, sudo filebeat test output. Step 5 is the line that command has to print before anyone is allowed to continue: talk to server... OK. That is…
2026-07-31 · 8 min read
Guides & TutorialsWhat Is a Use Case Library in SOCs?
SigmaHQ's proc_access_win_lsass_memdump.yml fires when a process opens a handle to lsass.exe with an access mask in its list. That is one behaviour, on one platform, from one telemetry source. It…
2026-07-31 · 10 min read
Guides & TutorialsWhat Is a Detection Playbook?
vssadmin.exe delete shadows /all /quiet runs on a file server at 03:12. The rule fires. The analyst on shift has been awake for nine hours and has never seen this alert before. What happens in the…
2026-07-31 · 9 min read