Home / Blog

The blog

Search results for incident response

All Alert Triage Detection Engineering Incident Response Threat Intelligence Threat Hunting SIEM and Tools Career and Certs Cheat Sheets Threat News

2 posts found

AdvancedIncident Response

How to Investigate Rogue Remote Access Tools in a Client Incident

Scope unauthorised AnyDesk, ScreenConnect and TeamViewer use across a client estate: find every install, read the session logs, build a timeline and contain it safely.

11 Nov 20269 min read

BeginnerAlert Triage

Triage a Brute Force Alert in 5 Steps (Event ID 4625)

A repeatable beginner workflow for the most common SOC alert: lots of failed Windows logons. Read the alert, enrich, scope, decide and document.

4 Nov 20262 min read