>_ the cyber track
Cyber Track Blog
Write-ups, attack paths and defensive notes on Active Directory, Linux, Windows and web security.
Featured articles
-
Linux Log Analysis for Defenders: auth.log, journalctl, and auditd
The Linux security model, where Linux logs live, and how auditd turns a server into a system you can investigate. Module 5 of The Complete Blue Team Course.
-
What Is a SIEM? Log Management and Security Monitoring Explained
What a SIEM actually does, how to write queries that matter, and how to manage log…
-
MITRE ATT&CK for Defenders: Mapping Detections to Techniques
How blue teams use MITRE ATT&CK to describe attacker behavior, track detection coverage, and build detections…
-
Threat Intelligence for Defenders: Turning Intel into Detections
What threat intelligence is for, the strategic, operational and tactical levels, and how defenders turn intel…
Browse all articles
-
Linux Log Analysis for Defenders: auth.log, journalctl, and auditd
The Linux security model, where Linux logs live, and how auditd turns a server into a system you can investigate. Module 5…
-
What Is a SIEM? Log Management and Security Monitoring Explained
What a SIEM actually does, how to write queries that matter, and how to manage log retention and cost. Module 6 of…
-
MITRE ATT&CK for Defenders: Mapping Detections to Techniques
How blue teams use MITRE ATT&CK to describe attacker behavior, track detection coverage, and build detections that produce signal instead of noise.…
-
Threat Intelligence for Defenders: Turning Intel into Detections
What threat intelligence is for, the strategic, operational and tactical levels, and how defenders turn intel into real detections. Module 8 of…
-
What Is EDR? Endpoint Detection and Response Explained
What EDR adds beyond antivirus, how to investigate an EDR alert by walking the process tree, and how to tune it. Module…
-
Network Security Monitoring with Wireshark and Zeek
Why network visibility still matters, how Wireshark and Zeek differ, and what defenders can learn from encrypted traffic. Module 10 of The…
-
Threat Hunting 101: How to Build a Hunt from a Hypothesis
Hunting vs alerting, how to structure a hunt from a hypothesis, and where hunt ideas come from. Module 11 of The Complete…
-
Incident Response Lifecycle: The Phases Every Defender Should Know
The standard phases of incident response, how to approach containment decisions under pressure, and how to make lessons learned actually change something.…
-
Digital Forensics Fundamentals: Order of Volatility and Chain of Custody
The order of volatility, memory forensics basics, and chain of custody. Module 13 of The Complete Blue Team Course.