SIGMA rules, KQL queries, threat hunting playbooks, and incident response guides — built by practitioners, for SOC analysts and detection engineers.
The 2011 kill chain trains you to stop malware at the perimeter. Identity-first attackers skip five of its seven links and log in. What to defend instead.
A detection engineer's map of the NHI vendor landscape — and why it's being acquired into platforms before it built the part that catches breaches.
Prompt injection is OWASP's #1 LLM risk and you can't filter it out. Stop detecting the prompt — detect the lethal trifecta closing in one session.
Cloud hands every workload a privileged identity by default. Unlike other machine identities it's bound to one host — use from elsewhere is theft.
An AI agent is a non-human identity with an opaque decision layer. You can't detect the prompt injection — so watch what the agent's credential does.
OAuth abuse bypasses MFA by attacking authorization, not authentication. Most SOCs don't collect consent-grant telemetry — here's what to detect.
SIGMA rules, detection logic, alert tuning
IOCs, TTPs, actor profiles, intel feeds
Playbooks, triage guides, forensics
Static/dynamic analysis, YARA rules
KQL, SPL, EQL — platform-specific content
Step-by-step guides for all levels
// learn by doing
Role-based, self-paced courses for detection engineers, SOC analysts, threat hunters, and incident responders. Free. No account required.
Get detection rules, threat intel, and tutorials delivered to your inbox.
No spam. Unsubscribe any time.