>_ the cyber track
Cyber Track Blog
Write-ups, attack paths and defensive notes on Active Directory, Linux, Windows and web security.
Featured articles
-
Linux Log Analysis for Defenders: auth.log, journalctl, and auditd
The Linux security model, where Linux logs live, and how auditd turns a server into a system you can investigate. Module 5 of The Complete Blue Team Course.
-
What Is a SIEM? Log Management and Security Monitoring Explained
What a SIEM actually does, how to write queries that matter, and how to manage log…
-
MITRE ATT&CK for Defenders: Mapping Detections to Techniques
How blue teams use MITRE ATT&CK to describe attacker behavior, track detection coverage, and build detections…
-
Threat Intelligence for Defenders: Turning Intel into Detections
What threat intelligence is for, the strategic, operational and tactical levels, and how defenders turn intel…
Browse all articles
-
Networking Fundamentals for Cybersecurity Defenders
The networking basics every defender needs: IP, TCP/UDP, DNS, DHCP, and how to tell normal traffic from attacks. Module 3 of The…
-
SOC Analyst Tiers Explained: How a Security Operations Center Works
How a security operations center (SOC) is structured, what Tier 1, 2 and 3 analysts do, and the difference between an in-house…
-
What Is Blue Team Security? A Beginner’s Guide to Cyber Defense
Learn what blue team security is, how it differs from red team, what defenders do every day, and how to start a…
-
What Is a SOC? Roles, Tiers and Daily Workflow
What is a SOC? A Security Operations Center is the team, the processes and the tools that watch an organization’s systems for…
-
SOC Analyst Tools: SIEM, EDR, SOAR and Ticketing
SOC analyst tools look overwhelming from the outside. Job posts list a dozen product names, and every vendor claims to do everything.…
-
Get-WinEvent Guide: Query Windows Logs in PowerShell
Get-WinEvent is the PowerShell cmdlet that turns Windows event logs into data you can filter, count and export. If you can write…
-
Linux Log Analysis: auth.log, journalctl and grep
Linux log analysis is mostly about knowing which file answers which question, and having a handful of commands you trust. You do…
-
Pyramid of Pain Explained with Real Detections
Not all indicators of compromise are equal. Blocking an IP address annoys an attacker for about five minutes. Detecting how they move…
-
Blue Team Home Lab: Build a Mini SOC for Free
You cannot learn blue team skills from slides alone. You need logs that you generated yourself, alerts that fired because you broke…