SIGMA rules, KQL queries, threat hunting playbooks, and incident response guides — built by practitioners, for SOC analysts and detection engineers.
The encryptor is the terminal event, not the attack. Detection didn't vanish when breakout hit 29 minutes. It relocated to the pre-encryption phases.
CTEM is not new, the integration is genuinely valuable, and the 'CTEM platform' is mostly rebranded BAS/ASM/RBVM. Buy the operating model, not the acronym.
The de-skilling fear has a long track record, and it usually turns into upskilling. Whether AI does that for your SOC is a deployment choice, not fate.
Lateral movement moved to the cloud control plane. Each hop is individually authorized, so single-event rules miss the chain.
216 technique IDs are not a decision surface. Translate detection coverage into named threats against crown-jewel assets, in dollars, with drill-down.
LOTL didn't add binaries. It commoditized chaining and moved to where EDR can't run. Stop detecting the binary. Detect the chain.
SIGMA rules, detection logic, alert tuning
IOCs, TTPs, actor profiles, intel feeds
Playbooks, triage guides, forensics
Static/dynamic analysis, YARA rules
KQL, SPL, EQL — platform-specific content
Step-by-step guides for all levels
// learn by doing
Role-based, self-paced training across the blue team — SOC, detection, threat hunting, IR, and CTI. Free. No account required.
Get detection rules, threat intel, and tutorials delivered to your inbox.
No spam. Unsubscribe any time.