Blog
Guides & TutorialsPlaybooks in threat hunting and incident response, in practice
A CACAO playbook is a JSON object with an id, a created timestamp and a workflow dictionary keyed by step identifiers. A Microsoft Sentinel playbook is an Azure Logic Apps workflow triggered by an…
2026-08-018 min read
Guides & TutorialsWhat Is MITRE ATT&CK? Tactics, Techniques and Rule Tagging
The Enterprise matrix on attack.mitre.org lists 15 tactic columns, and Discovery alone carries 34 techniques. Persistence holds 22, Execution 20, Command and Control 18. Those columns are not a kill…
2026-08-018 min read
Guides & TutorialsWhat Is a SOC Runbook?
Step 4 of a log source onboarding runbook is one command, sudo filebeat test output. Step 5 is the line that command has to print before anyone is allowed to continue: talk to server... OK. That is…
2025-08-288 min read
Guides & TutorialsWhat Is a Use Case Library in SOCs?
SigmaHQ's proc_access_win_lsass_memdump.yml fires when a process opens a handle to lsass.exe with an access mask in its list. That is one behaviour, on one platform, from one telemetry source. It…
2024-10-2010 min read
Guides & TutorialsWhat Is a Detection Playbook?
vssadmin.exe delete shadows /all /quiet runs on a file server at 03:12. The rule fires. The analyst on shift has been awake for nine hours and has never seen this alert before. What happens in the…
2024-09-239 min read