Category: Detection Engineering

Category: Detection Engineering

All from controlled labs to real-world incident analysis, focused on detection, investigation, and response.

Zeek Traffic Analysis & Threat Hunting | DNS Tunneling, Phishing, Log4Shell Detection

Zeek traffic analysis covering DNS tunneling detection, phishing investigation, Log4Shell exploitation attempts, Zeek signatures, Zeek scripts, and threat hunting through PCAP and log analysis.

View >>

Snort Rules: Powerful IDS/IPS Traffic Detection and Threat Blocking

Snort Rules Writing: Lab walkthrough covering IDS/IPS alert triage, reverse shell threat detection, brute-force blocking, and custom Snort rules.

View >>

Analyzing Network Attacks with Wireshark & Snort: From Visibility to Detection

Learn how to detect real-world network attacks using Wireshark and Snort, including Log4Shell, HTTP analysis, and custom IDS rule creation.

View >>

Building a SOC Detection Lab with Sysmon and Microsoft Sentinel

Documentation and implementation of a personal SOC detection lab using Windows telemetry and cloud-native SIEM monitoring.

View >>

Learning SOC the Hard Way: Practical Security Analysis & Detection

SOC 101 from the trenches — phishing analysis, network forensics, Snort rules, endpoint compromise, SIEM logs, YARA detection, and privacy.

View >>