Linux SSH Log Cheat Sheet for Beginner SOC Analysts
Where Linux keeps SSH logs, what each common log line means and the simple grep and journalctl commands that tell you who logged in, from where and how.
9 Nov 20267 min read
All
Alert Triage
Detection Engineering
Incident Response
Threat Intelligence
Threat Hunting
SIEM and Tools
Career and Certs
Cheat Sheets
Threat News
11 posts found
How to Build a Home SOC Lab with Free Tools
A beginner friendly plan for a home SOC lab using Windows evaluation builds, Sysmon, a free SIEM and Atomic Red Team, plus how to turn it into interview evidence.
7 Nov 20267 min read
Windows Logon Events Cheat Sheet: Event IDs, Types and Failure Codes
A shift-ready reference for Windows logon event IDs, logon types and failure codes, with KQL, SPL and PowerShell to show who logged on, from where and how.
5 Nov 20268 min read
How to Hunt for C2 Beaconing in Proxy and EDR Logs
Find regular callback traffic in proxy and EDR logs with interval analysis in KQL and SPL, then separate real command and control from noisy legitimate software.
5 Nov 20269 min read
Triage a Brute Force Alert in 5 Steps (Event ID 4625)
A repeatable beginner workflow for the most common SOC alert: lots of failed Windows logons. Read the alert, enrich, scope, decide and document.
4 Nov 20262 min read
SOC Analyst Interview Prep: Technical Questions for Beginners
The networking, Windows log and alert triage questions that entry level SOC interviews often include, with simple ways to answer them clearly and what to study first.
4 Nov 20268 min read
How to Detect LSASS Memory Access with Sysmon Event ID 10
Build a tuned LSASS access detection from Sysmon Event ID 10, with Splunk, Sentinel and Sigma versions, plus triage steps and the hardening that reduces your risk.
2 Nov 202612 min read
How to Triage an Encoded PowerShell Alert
A step by step way to decode an encoded PowerShell command, check its parent process and related activity, and decide whether to close or escalate.
1 Nov 20268 min read
How to Hunt for Kerberoasting After the 2026 RC4 Changes
RC4 is now off by default on domain controllers, so old Kerberoasting rules go quiet. Hunt AES ticket bursts, leftover RC4 accounts and decoy SPNs instead.
29 Oct 202610 min read