blue team operations
& SOC analysis
Over 118 live security alerts investigated, triaged, and documented — each one mapped to known attacker behaviour and written up with full methodology. 174+ completed lab scenarios covering network forensics, malware analysis, cloud intrusions, and incident response. Everything on this site is real work, publicly linked, and verifiable.
HTB proctored certification exam covering SOC fundamentals, alert triage workflows, SIEM analysis with Splunk & Elastic, threat intelligence & IOC correlation, digital forensics, incident response, phishing analysis, malware detection, and network traffic analysis.
Hands-on certification covering five SOC domains — phishing analysis, digital forensics, threat intelligence, SIEM investigation, and incident response. Passed first attempt.
CyberDefenders certification exam covering SIEM operations, digital forensics, incident response, threat intelligence, and network/endpoint/email security across realistic SOC investigation scenarios.
- Real-world SIEM alert triage
- Log analysis & correlation
- Malware investigation & IOC identification
- Incident documentation & reporting
- Threat intelligence integration
- Alert classification — true positive / false positive with written justification
- Regex pattern construction with detection-logic explanations
- YARA rule authoring against real indicators of compromise
- Sigma rule writing & tuning with detection logic explanations
- Adversary emulation testing across MITRE ATT&CK TTPs
- Static & dynamic malware analysis
- Sample triage & IOC extraction
- Behavioural analysis in a sandbox
- Malware classification & reporting
- SIEM alert triage & log correlation
- Network forensics & PCAP analysis
- Memory forensics & disk image analysis
- Threat intelligence & IOC attribution
- Incident response & malware investigation
- Memory forensics & volatile data analysis
- Disk image forensics & file recovery
- Malware triage & static analysis
- Threat actor attribution & TI correlation
- Advanced incident response workflows
- Alert triage & log analysis across SOC scenarios
- PCAP investigation & network forensics
- Threat intelligence & IOC correlation
- Incident response workflows
- Defensive reasoning & escalation methodology
- Live Virtual SOC alert queue — Tier 1 through Tier 2 investigations
- Network traffic analysis, email/header analysis, live Windows host triage, SIEM log hunting
- DFIR methodology, timeline construction, playbook-driven investigation
- Capstone incident report — IOC documentation, executive summary, technical analysis, remediations
- Graded, section-by-section manual review — no automated scoring
One real LetsDefend alert per day, triaged out loud on camera. Structured workflow, log correlation, containment decisions — real analyst thinking documented publicly.
▶ Full CyberDefenders lab walkthroughs on YouTube — every question answered, every tool and technique explained from scratch. Endpoint forensics, malware analysis, and threat investigation.
Every alert triaged, documented, and mapped to MITRE ATT&CK. Updated daily as part of the Day N of Becoming a SOC Analyst series.
Reusable KQL detection patterns auto-extracted from KC7 lab investigations — write the writeup once, every tagged query promotes itself into a searchable reference. Capability over completion: the queries are the takeaway.
Every technique observed across labs and investigations mapped to MITRE ATT&CK Enterprise. Generated live from documented writeups — no manual curation.
Twelve investigations selected across core blue team disciplines. Hard-rated labs, real artefacts, documented methodology.
All platforms, all labs. Filter by platform, difficulty, or category. Adding new labs weekly.
Writeups are complete but locked until these labs officially retire. Reach out if you need the password.
HTB Sherlocks — DFIR investigations covering endpoint forensics, threat intelligence, network analysis, and memory forensics.
Writeups complete but locked until these sherlocks officially retire. Reach out if you need the password.
Shorter CTF-style challenges. Same platforms, less depth.
- 118 investigations logged & counting
- 102 true positives · 16 false positives
- 95 unique MITRE ATT&CK techniques observed
- Latest: SOC235 — Confluence Broken Access Control 0-…
- 26 commands and growing
- Volatility · Splunk · Wireshark · Zeek
- Linked back to source lab for context
- Auto-extracted from investigation notes
- LetsDefend — 34 cases, 97% success
- TryHackMe — 46 cases, 100% detection
- GitHub — full writeup repository
- Real-time metrics & platform rankings
- BTL1 exam review — preparation & lessons
- Day 100: reflections on daily alert triage
- Not a blog. Just writing.