blue team operations
& SOC analysis
Over 83 live security alerts investigated, triaged, and documented — each one mapped to known attacker behaviour and written up with full methodology. 210+ completed lab scenarios covering network forensics, malware analysis, cloud intrusions, and incident response. Everything on this site is real work, publicly linked, and verifiable.
HTB proctored certification exam covering SOC fundamentals, alert triage workflows, SIEM analysis with Splunk & Elastic, threat intelligence & IOC correlation, digital forensics, incident response, phishing analysis, malware detection, and network traffic analysis.
Hands-on certification covering five SOC domains — phishing analysis, digital forensics, threat intelligence, SIEM investigation, and incident response. Passed first attempt.
- Real-world SIEM alert triage
- Log analysis & correlation
- Malware investigation & IOC identification
- Incident documentation & reporting
- Threat intelligence integration
- SIEM alert triage & log correlation
- Network forensics & PCAP analysis
- Memory forensics & disk image analysis
- Threat intelligence & IOC attribution
- Incident response & malware investigation
- Memory forensics & volatile data analysis
- Disk image forensics & file recovery
- Malware triage & static analysis
- Threat actor attribution & TI correlation
- Advanced incident response workflows
- Alert triage & log analysis across SOC scenarios
- PCAP investigation & network forensics
- Threat intelligence & IOC correlation
- Incident response workflows
- Defensive reasoning & escalation methodology
One real LetsDefend alert per day, triaged out loud on camera. Structured workflow, log correlation, containment decisions — real analyst thinking documented publicly.
Every alert triaged, documented, and mapped to MITRE ATT&CK. Updated daily as part of the Day N of Becoming a SOC Analyst series.
Every technique observed across labs and investigations mapped to MITRE ATT&CK Enterprise. Generated live from documented writeups — no manual curation.
Twelve investigations selected across core blue team disciplines. Hard-rated labs, real artefacts, documented methodology.
All platforms, all labs. Filter by platform, difficulty, or category. Adding new labs weekly.
Writeups are complete but locked until these labs officially retire. Reach out if you need the password.
Shorter CTF-style challenges. Same platforms, less depth.
- — investigations logged & counting
- — true positives · — false positives
- — unique MITRE ATT&CK techniques observed
- Latest: —
- 26 commands and growing
- Volatility · Splunk · Wireshark · Zeek
- Linked back to source lab for context
- Auto-extracted from investigation notes
- LetsDefend — 34 cases, 97% success
- TryHackMe — 46 cases, 100% detection
- GitHub — full writeup repository
- Real-time metrics & platform rankings
- BTL1 exam review — preparation & lessons
- Day 100: reflections on daily alert triage
- Not a blog. Just writing.