XXIII

Your SIEM is showing you thousands of events. Now imagine your manager asks: “Find every failed login from this IP in the last 24 hours.” This is where knowing SQL becomes useful. Cybersecurity generates a ridiculous amount of data. Knowing how to ask that data the right questions is a skill every aspiring SOC analyst should build. @defendtheorg has a SQL Basics path where you can start practising this from the ground up. Stop treating SQL as a “developer skill.” It’s a data investigation skill too.

How do you actually solve a Security Operations lab? I put together a quick walkthrough using a DefendTheOrg lab, from reading the alert to investigating logs, selecting the right evidence, and making the final triage decision. If you're trying to build practical SOC skills, this is the kind of practice you should be doing. Learn. Investigate. Make decisions. Build proof. Try it yourself 👇

I honestly wonder why most of you haven't started taking advantage of the real-world cybersecurity scenarios you can find on DTO. You keep asking: “What should I learn?” “How do I get experience?” “How do I become job-ready?” But when you have a platform giving you structured paths, realistic scenarios, hands-on challenges and problems that actually make you think like a security analyst, many of you are still watching another 3-hour YouTube video. At some point, you have to stop consuming and start practising. DTO can help you build practical cybersecurity skills in months if you actually put in the work. Not by magically making you job-ready, but by giving you a place to learn, practise, make mistakes, solve problems and build proof of what you can do. If you're serious about getting into cybersecurity, what exactly are you waiting for? Go explore it yourself: defendtheorg.com/r/MASKOFF02…

DTO just added its 10th skill: Purple Teaming. And I think this is one of the features that makes the platform different. So what exactly is Purple Teaming? It’s about bringing the Red Team and Blue Team perspectives together. The Red Team thinks like the attacker: How would an attacker gain access? What techniques would they use? How would they move through the environment? What would their attack chain look like? The Blue Team looks at the other side: Did we detect it? What logs were generated? Did our SIEM or detection rules catch it? What did we miss? How can we improve the detection? Purple Teaming connects both sides. You take an attack or adversary technique, see what the defensive controls catch, identify the gaps, tune your detections, map the activity to MITRE ATT&CK, and then test the attack again. That creates a really useful learning loop: Attack → Detect → Identify gaps → Improve → Test again. For cybersecurity students, this helps connect the theory you're learning to what actually happens during an attack and how defenders respond. For SOC analysts and Blue Teamers, it helps you think beyond simply responding to alerts. You start understanding why the attacker generated those alerts in the first place and how your detection could be improved. For aspiring Detection Engineers and Threat Hunters, this is especially valuable because you're practising the process of turning attacker behaviour into meaningful detections. And for Red Teamers, understanding how defenders detect your activity gives you a better understanding of the defensive side of the environment. That's why I think Purple Teaming is such a valuable addition to DTO. It's not just another collection of labs. You're being encouraged to understand both sides of the fight and use that knowledge to improve security. This is one of the reasons I consider DTO unique. If you're learning cybersecurity, go explore the Purple Team section and see what they're building. defendtheorg.com/r/MASKOFF02…

Suspicious Login Pattern Hunt Scenario: A threat intelligence team discovers that employee credentials from a recent third-party breach may be circulating on the dark web. The team wants to know: Are any of those compromised credentials already being used to access the organisation? As the analyst, you’re given VPN authentication logs and asked to investigate suspicious login activity. The interesting part is the hypothesis: An attacker may be using compromised employee credentials to access internal systems from an unusual geographic location. There’s also an important piece of context: HR confirmed that no employees are currently travelling internationally. So now you have to investigate the login patterns, look for unusual locations and behaviour, and determine whether the activity could indicate credential abuse. This is the kind of scenario I like seeing beginners practise because it puts you in the mindset of an actual analyst. You’re not just learning what threat hunting means. You’re given a hypothesis, business context, logs and a security problem to investigate. DTO has several hands-on exercises like this across different areas of cybersecurity. If you're learning SOC/Blue Team, don't just watch videos. Get your hands on some logs and start hunting. defendtheorg.com/r/MASKOFF02…

I was less busy today, so I decided to visit DTO and honestly, I was impressed. I realised how much the platform has grown over the past few months. Looking at it now, I genuinely wish something like this existed when I started learning cybersecurity. For beginners, having a structured place to learn, practise, follow challenges, and actually build hands-on experience can make the journey a lot less confusing. If you’re currently learning cybersecurity and tired of jumping from one random resource to another, explore DTO yourself and see what I mean. defendtheorg.com/r/MASKOFF02…