Blog
Security OperationsWhat Is UEBA?
Microsoft Sentinel's BehaviorAnalytics table stores an integer called InvestigationPriority, scored 0 to 10, where 0 is benign and 10 is highly anomalous. That integer is the whole promise and the…
2025-08-069 min read
Security OperationsWhat Is an NDR?
An ESXi host, a badge controller and a load balancer have one thing in common. No EDR agent runs on any of them, and none of them will ever accept one. Network detection and response is the tooling…
2025-07-1810 min read
Security OperationsWhat Is an XDR?
EmailAttachmentInfo.SHA256 is the field you would join on to prove that a phishing attachment executed on an endpoint. Microsoft's own schema reference says that field is usually not populated and…
2025-07-139 min read
Security OperationsWhat Is an EDR?
fltmc.exe unload takes one line and about two seconds. If it succeeds against your endpoint agent's file system filter, the file telemetry stops and nothing in the console says so. That single…
2025-06-259 min read
Security OperationsWhat Is a SIEM?
Sysmon Event ID 1 carries a field called CommandLine. By the time a detection queries that value in Splunk it is Processes.process, in Elastic it is process.command_line, and in Microsoft Sentinel's…
2025-06-168 min read
Security OperationsWhat Is a SOC (Security Operations Center)?
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 720 lsass.dmp full fires a rule at 02:14. Everything that happens between that timestamp and the ticket closing is the SOC. A security operations…
2025-06-0610 min read
Security OperationsWhat Is Alert Fatigue in SOCs?
Close every alert from a rule that fires 200 times a day and catches one intrusion a year, and you are right 99.975 percent of the time. That is the whole problem in one line. The analyst who…
2025-05-289 min read
Security OperationsWhat Is Patch Management in Security?
Log4j 2.17.1 on disk does not fix anything if the JVM that loaded 2.14.1 has been up for two hundred days. The file is patched. The process is not. Every vulnerability scanner in the building will…
2025-05-1510 min read
Vulnerabilities & ExploitsWhat is vulnerability management?
About 6% of published CVEs are ever exploited in the wild. A scanner reports the other 94% with the same red badge. That gap is the entire job. Buying a scanner takes an afternoon. Running a…
2025-04-2811 min read
Vulnerabilities & ExploitsWhat Is a Zero-Day Vulnerability?
An operator wrote human2.aspx into C:\MOVEitTransfer\wwwroot\ four days before Progress had a patch to give anyone. CISA's KEV entry for the bug behind it lists CWE-89. SQL injection, the same class…
2025-04-158 min read
Vulnerabilities & ExploitsWhat Is Exploit Chaining?
One request, no credentials, and the appliance runs whatever sits inside the ${}. GET…
2025-04-087 min read
Vulnerabilities & ExploitsWhat is CVSS and why severity is not risk
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H scores 10.0. That string is the Base vector Palo Alto Networks published for CVE-2024-3400. It says nothing about whether the…
2025-03-309 min read