22 posts found
A beginner guide to the five Splunk basics every SOC analyst uses first: index, host, source, sourcetype and time range, with short searches and what to check when results look wrong.
Build detections for shadow copy deletion, backup catalog wipes and disabled Windows recovery, tune them per client and contain fast when they fire.
Set up Azure Lighthouse access, write workspace() queries that label every client and learn the limits of cross workspace rules before you run a multi tenant SOC on them.
Work out what a user consented to, whether the app has touched any data and how to remove it safely, with KQL for Entra audit, sign in and Graph activity logs.