Triage a Brute Force Alert in 5 Steps (Event ID 4625)
A repeatable beginner workflow for the most common SOC alert: lots of failed Windows logons. Read the alert, enrich, scope, decide and document.
4 Nov 20262 min read
All
Alert Triage
Detection Engineering
Incident Response
Threat Intelligence
Threat Hunting
SIEM and Tools
Career and Certs
Cheat Sheets
Threat News
2 posts found
How to Triage an Encoded PowerShell Alert
A step by step way to decode an encoded PowerShell command, check its parent process and related activity, and decide whether to close or escalate.
1 Nov 20268 min read