Knowledge Hub
The reference I wish I’d had.
Practical, evergreen notes on the work: how a SOC runs, reading a capture, hunting in KQL, writing detections that hold up, and securing the platform underneath. I wrote them for myself, then cleaned them up so they’re useful to anyone on the same ground. Search runs across every article and its sections.
3 articles · press / to search
Networking & Packet Analysis
2 articlesThe wire-level knowledge an analyst leans on: ports, protocols, and how to read a packet capture.
Ports & port numbers
What a port actually is, how TCP and UDP differ, and which ports matter to an attacker and to a defender at each stage of an intrusion.
Wireshark for the SOC
How to read a capture file the way an analyst does: the walkthrough from capture to written finding, the display filters by protocol, the attack patterns to recognise, and what still leaks once traffic is encrypted.
Microsoft Sentinel
1 articleRunning Sentinel day to day and engineering it: data connectors, analytics, automation.