ISC2 CC | Building toward Tier 1 SOC and Detection Engineering | Hands-on investigations with Splunk, Wazuh and Sigma | Documenting what I learn
Johannesburg, South Africa
Joined March 2020
- Tweets25.9K
- Following1.5K
- Followers2.7K
- Likes31.2K
Cyber Awareness Day 27
"Suspicious activity investigated. Escalated."
That tells the next analyst almost nothing
A good SOC report explains what triggered the alert, what was verified, what remains unknown and why it was escalated
Document your reasoning, not just your actions
William | SOC and Detection Engineering retweeted
ICYMI
New video!
RT's and likes appreciated 🤝
Is Your SOC Job a Dead End? Here’s What’s Next
youtu.be/ej_YPIPCYZU
My Ubuntu VM crashed in UTM.
I rebuilt it from scratch and documented the journey to reconnect it to Splunk Enterprise.
Now I can search audit activity from that endpoint in my SIEM.
Here's the workflow I followed and what someone building a SOC lab can learn from it.
My final Splunk search:
index=main host=ubuntu sourcetype="linux:audit" "identity_changes"
It returned 2 records:
A successful chmod operation and an audit configuration change.
This confirmed that the specific Ubuntu audit activity was searchable in Splunk.
William | SOC and Detection Engineering retweeted
The chmod activity appeared in my Ubuntu audit logs.
But could I find that exact evidence in Splunk?
That's the next step in my Ubuntu → Splunk rebuild.
In Part 08, I'm moving from local audit investigation to searching the same activity in my SIEM.
William | SOC and Detection Engineering retweeted
Nothing tests your patience like someone owing you money and posting pictures of themselves enjoying life.
You're happy they're doing well, but your money would also like to come home. 😂
William | SOC and Detection Engineering retweeted
A VPN protects your connection, not your entire device.
It encrypts traffic between your device and the VPN endpoint.
But it won't stop phishing, malware, or stolen credentials.
Privacy and security aren't the same thing.
William | SOC and Detection Engineering retweeted
Your browser loads a website.
But what happens behind the scenes?
HTTP is the protocol browsers and web servers use to exchange requests and responses.
Unlike HTTPS, HTTP does not encrypt that traffic.
Security lesson: Never send sensitive data over plain HTTP.
William | SOC and Detection Engineering retweeted
A cybersecurity definition tells you what something means.
An investigation teaches you how to recognize it, question it, and look for supporting evidence.
Both matter. But understanding the term is only the beginning.
William | SOC and Detection Engineering retweeted
I’ve been conducting recon & enumeration on a public server IP.
Every time I do this, I’m reminded how easy it is for exposed systems to go unnoticed. until they’re not.
Taking security seriously is about protecting the work,the data, and the people who depend on those systems.
William | SOC and Detection Engineering retweeted
Day 58 as a SOC analyst.
A system can be vulnerable for months before anyone tries to exploit it.
That’s what makes vulnerability management important.
Attackers don’t necessarily need sophisticated techniques sometimes, they just need an unpatched service or a known weakness that hasn’t been addressed.
And when a potential exploit is detected the question isn’t just whether the alert is genuine. It’s whether the targeted system was affected and whether there are signs of further malicious activity.
Patching matters monitoring matters but knowing whether an attack actually succeeded matters too.
Day 58 as a SOC analyst.
Not every data leak starts with a hacker breaking into a system. Sometimes it starts with someone sending a work document to the wrong email address, uploading a sensitive file to a personal cloud account, or transferring company data through an unapproved platform.
The problem is that once sensitive information leaves the approved environment, controlling who can access it becomes much harder.
So before sharing or transferring a file, double check the recipient, the sensitivity of the information, and whether the channel is approved for that data.
Sending a file is very fast but recovering exposed data is hard
5 Linux logs every SOC analyst should know
/var/log/auth.log → Login activity
/var/log/syslog → System events
/var/log/kern.log → Kernel messages
/var/log/audit/audit.log → Audit events
/var/log/secure → Authentication logs (RHEL)
Know where to look before investigating
A cybersecurity definition tells you what something means.
An investigation teaches you how to recognize it, question it, and look for supporting evidence.
Both matter. But understanding the term is only the beginning.
Windows Event ID 4624 records successful logons.
But a successful remote logon doesn't automatically mean lateral movement.
It could be legitimate administrative activity.
That's why account, source, logon type, and surrounding activity matter.