Blog
Security OperationsWhat Is Event Correlation in SIEM?
Windows Security event 4625 on its own is a typo. Thirty of them against thirty different account names from one source address in fifteen minutes, followed by a 4624 from that same address, is a…
2026-04-0610 min read
Security OperationsWhat Is Log Normalization in SIEMs?
Sysmon calls it Image. Windows Security event 4688 calls it NewProcessName. Microsoft Defender for Endpoint splits the same thing into FolderPath and FileName. All three describe one executable…
2026-02-268 min read
Security OperationsWhat Is SOAR?
POST /devices/entities/devices-actions/v2?action_name=contain takes a CrowdStrike host off the network. action_name=lift_containment puts it back. Both are one HTTP call against the same endpoint,…
2025-08-1810 min read
Security OperationsWhat Is UEBA?
Microsoft Sentinel's BehaviorAnalytics table stores an integer called InvestigationPriority, scored 0 to 10, where 0 is benign and 10 is highly anomalous. That integer is the whole promise and the…
2025-08-069 min read
Security OperationsWhat Is an NDR?
An ESXi host, a badge controller and a load balancer have one thing in common. No EDR agent runs on any of them, and none of them will ever accept one. Network detection and response is the tooling…
2025-07-1810 min read
Security OperationsWhat Is an XDR?
EmailAttachmentInfo.SHA256 is the field you would join on to prove that a phishing attachment executed on an endpoint. Microsoft's own schema reference says that field is usually not populated and…
2025-07-139 min read
Security OperationsWhat Is an EDR?
fltmc.exe unload takes one line and about two seconds. If it succeeds against your endpoint agent's file system filter, the file telemetry stops and nothing in the console says so. That single…
2025-06-259 min read
Security OperationsWhat Is a SIEM?
Sysmon Event ID 1 carries a field called CommandLine. By the time a detection queries that value in Splunk it is Processes.process, in Elastic it is process.command_line, and in Microsoft Sentinel's…
2025-06-168 min read
Security OperationsWhat Is a SOC (Security Operations Center)?
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 720 lsass.dmp full fires a rule at 02:14. Everything that happens between that timestamp and the ticket closing is the SOC. A security operations…
2025-06-0610 min read
Security OperationsWhat Is Alert Fatigue in SOCs?
Close every alert from a rule that fires 200 times a day and catches one intrusion a year, and you are right 99.975 percent of the time. That is the whole problem in one line. The analyst who…
2025-05-289 min read
Security OperationsWhat Is Patch Management in Security?
Log4j 2.17.1 on disk does not fix anything if the JVM that loaded 2.14.1 has been up for two hundred days. The file is patched. The process is not. Every vulnerability scanner in the building will…
2025-05-1510 min read