SOC Analysis

EDR (Endpoint Detection & Response)

edr · soc

Elastic Stack (ELK)

elk · siem · soc

Windows Event Viewer (Quick Notes)

windows · event-viewer · soc

SIEM (Security Information & Event Management)

siem · logs · soc

SOAR

soar · automation · soc

SOC Frameworks — Pyramid of Pain

Why a malware hash is the weakest indicator you can act on and a TTP is the strongest — mapped to what a SOC analyst should actually do at each level of the pyramid.

pyramid-of-pain · threat-intel · soc

Splunk (Core Components)

splunk · siem · soc