Defensive Security

Lesson 1Inside the Security Operations Center

A SOC is a process wrapped around people and telemetry. Alerts arrive, an analyst triages, and either closes them with a documented reason or escalates. The quality of a SOC is measured in mean time to detect and mean time to respond.

• •True positive — real malicious activity; escalate and contain
• •False positive — benign activity matching a rule; tune the rule
• •True negative — quiet and genuinely safe
• •False negative — the dangerous one: missed activity, found later during a hunt

Lesson 2Network analysis

Attackers must communicate. Network telemetry — full packet capture, flow records, DNS and proxy logs — is where command-and-control, beaconing and exfiltration become visible even when the endpoint is compromised.

# Wireshark display filters worth memorising
http.request.method == "POST"
dns.qry.name contains "dyndns"
tcp.flags.syn == 1 && tcp.flags.ack == 0   # scanning behaviour
ip.addr == 10.10.10.5 && !(tcp.port == 443)

• •Beaconing — regular, similar-sized callbacks at a fixed interval with jitter
• •Exfiltration — large or sustained outbound transfer to an unusual destination
• •DNS tunnelling — long, high-entropy subdomain labels, high query volume
• •Lateral movement — internal SMB/RDP/WinRM connections between workstations

Lesson 3Log monitoring and SIEM

A SIEM collects, normalises and correlates logs so one query can span the whole estate. Detection engineering is the craft of turning attacker behaviour into precise, low-noise logic.

// Pseudo-SIEM rule: password spraying
source = "windows:security" AND event_id = 4625
| bin span=10m
| stats dc(target_user) AS users, count AS attempts BY src_ip, _time
| where users >= 10 AND attempts >= 20

Lesson 4Incident response

The NIST lifecycle gives incidents a repeatable shape: Preparation, Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity. Under pressure, the process is what keeps decisions sane.

• •Preparation — playbooks, contacts, logging coverage, tested backups
• •Detection & analysis — validate the alert, build a timeline, scope affected assets
• •Containment — short-term isolation first, then a durable fix
• •Eradication & recovery — remove persistence, rebuild, restore, verify
• •Post-incident — blameless review, new detections, updated playbook

Preserve evidence in order of volatility: memory and running processes before disk, disk before archived logs. Isolating a host at the network level usually beats powering it off.

Lesson 5Threat hunting

Hunting assumes the alert never fired. You start with a hypothesis grounded in a real technique — 'an attacker is using scheduled tasks for persistence on finance workstations' — then query telemetry to prove or disprove it.

• •Pick a MITRE ATT&CK technique relevant to your environment
• •Define the data source and what normal looks like
• •Query for the deviation, not the malware name
• •Whatever the result, output a new detection rule or a documented baseline