Blog
Threat hunting and detection engineering, written down: the reporting behind rules, the telemetry that feeds them, and the gaps that get attackers through.
9 articles
Security OperationsWhat Is SOAR?
POST /devices/entities/devices-actions/v2?action_name=contain takes a CrowdStrike host off the network. action_name=lift_containment puts it back. Both are one HTTP call against the same endpoint,…
2026-07-31 · 10 min read
Security OperationsWhat Is UEBA?
Microsoft Sentinel's BehaviorAnalytics table stores an integer called InvestigationPriority, scored 0 to 10, where 0 is benign and 10 is highly anomalous. That integer is the whole promise and the…
2026-07-31 · 9 min read
Security OperationsWhat Is an NDR?
An ESXi host, a badge controller and a load balancer have one thing in common. No EDR agent runs on any of them, and none of them will ever accept one. Network detection and response is the tooling…
2026-07-31 · 10 min read
Security OperationsWhat Is an XDR?
EmailAttachmentInfo.SHA256 is the field you would join on to prove that a phishing attachment executed on an endpoint. Microsoft's own schema reference says that field is usually not populated and…
2026-07-31 · 9 min read
Security OperationsWhat Is an EDR?
fltmc.exe unload takes one line and about two seconds. If it succeeds against your endpoint agent's file system filter, the file telemetry stops and nothing in the console says so. That single…
2026-07-31 · 9 min read
Security OperationsWhat Is a SIEM?
Sysmon Event ID 1 carries a field called CommandLine. By the time a detection queries that value in Splunk it is Processes.process, in Elastic it is process.command_line, and in Microsoft Sentinel's…
2026-07-31 · 8 min read
Security OperationsWhat Is a SOC (Security Operations Center)?
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 720 lsass.dmp full fires a rule at 02:14. Everything that happens between that timestamp and the ticket closing is the SOC. A security operations…
2026-07-31 · 10 min read
Security OperationsWhat Is Alert Fatigue in SOCs?
Close every alert from a rule that fires 200 times a day and catches one intrusion a year, and you are right 99.975 percent of the time. That is the whole problem in one line. The analyst who…
2026-07-31 · 9 min read
Security OperationsWhat Is Patch Management in Security?
Log4j 2.17.1 on disk does not fix anything if the JVM that loaded 2.14.1 has been up for two hundred days. The file is patched. The process is not. Every vulnerability scanner in the building will…
2026-07-31 · 10 min read