Blue Team (Defense and Protection) These are the people protecting systems and responding to attacks: SOC Analyst Cybersecurity Analyst Security Analyst Incident Response Analyst Incident Responder Threat Hunter Threat Intelligence Analyst Malware Analyst

Day 17 Two identity concepts that get used as synonyms and are not the same thing 👇

AI cannot investigate evidence your environment never collected. I learned this when my Windows agent was configured but pointing to the wrong address. The dashboard showed nothing because the telemetry never arrived.

A stateful firewall remembers the conversation. It tracks whether traffic belongs to an established session, not just whether a port is open. Reflex: if it judges packets by connection context, it is stateful. Port-only judgement is stateless.

Typosquatting weaponises a spelling mistake. The attacker registers a near-miss of a real domain and waits for fingers to slip. Reflex: if the attack lives in a misspelled lookalike domain, it is typosquatting.

Some interview questions rarely change. But the quality of the answer depends on how well I understand myself. That is why I am practising the core questions before I enter an interview.

A stateful firewall remembers the conversation. It tracks whether traffic belongs to an established session, not just whether a port is open. Reflex: if it judges packets by connection context, it is stateful. Port-only judgement is stateless.

My resume has a new rule: If I cannot open the evidence, the claim does not stay. Writing “investigated suspicious authentication activity” is easy. Proving it is different.

The most dangerous vulnerability is often the one everyone assumes someone else has fixed.

DNS poisoning sends you to the wrong place with the right name. The address bar looks correct. The resolver was fed a bad record, so the trusted name points at the attacker's server. Reflex: correct name, wrong destination, it is DNS poisoning.

A suspicious email lands in an employee’s inbox. It contains an urgent account verification request and a potentially malicious link. As a Tier 1 SOC analyst, here is how I would investigate it:

Elasticity and scalability sound alike and are not. Scalability is growing capacity to meet long-term demand. Elasticity is expanding and shrinking automatically in real time. Reflex: scalability plans for growth. Elasticity reacts to the moment.

The part of building a home lab that tutorials rarely show is the troubleshooting. One project can bring failed configurations, confusing errors, Google searches and hours of reading documentation.

SOC Home Lab Series | Part 17 Once the lab was built, I stopped treating it like a collection of tools. I needed a workflow I could repeat like an analyst. So I started with one question: What happened, and what evidence can prove it?

I created the same scheduled task two different ways. The Sigma rule detected schtasks.exe. Then I used Schedule.Service COM. The task was created successfully. The detection saw nothing. Same behavior. Different path. Different visibility.

ARP poisoning lies to the network about who owns an address. The attacker maps their own MAC to a trusted IP, so traffic meant for the gateway comes to them. Reflex: if the attack corrupts the IP-to-MAC mapping, it is ARP poisoning.

Day 1 of learning Splunk, I had a search bar in front of me and genuinely had no idea what to type. 28 days later, I was writing SPL to detect a Hydra SSH brute-force I generated inside my own lab.

SOC Home Lab Series | Part 16 After investigating the SSH activity in Splunk, I checked what Wazuh actually detected. This exposed something I had not expected: the rule IDs in my Wazuh 4.14.6 environment did not match several older tutorials I had seen.

I’m building in public toward Tier 1 SOC and Detection Engineering roles. I share: Home lab builds Alert triage and investigations SIEM, EDR and network telemetry Detection logic and troubleshooting No production claims. Just evidence of what I’m learning, testing and building.

SOC Home Lab Series | Part 15 After all the setup, I finally used the lab for what I built it for: investigation. My first test was an SSH brute force against Ubuntu. Kali generated the activity. Then I stopped looking at Kali and opened Splunk.

Some books teach me what to do. Others make me question who I am becoming. I read because I never want to stop growing, thinking, or searching for deeper understanding. The more I learn about life, the more I realize how much I still don’t know.

A SIEM can find the event. But it cannot do the thinking for you. Why did it happen? What happened before it? What happened next? Does the evidence support the alert? The tool gives you data. The investigation gives it meaning.

Every attack leaves evidence, but evidence without interpretation is only data.

SOC Home Lab Series | Part 14 After connecting my Wazuh agents, I stopped trusting one thing: “Service running.” An agent can be running perfectly on the endpoint and still not be communicating with the manager.

Pretexting is the story that makes social engineering work. The attacker invents a believable scenario, the new IT tech, the auditor, so the request feels normal. Reflex: if there is a fabricated backstory setting up the ask, that setup is pretexting.

I don’t want the first time I investigate a brute force attack to be after someone hires me. So I created one myself. In my home lab, Kali generated SSH authentication attempts against Ubuntu. Then I stopped thinking like the attacker and opened the logs.

Day 16 Two recovery metrics that sound identical and measure completely different disasters 👇

Detective controls do not stop anything. They tell you it happened. A camera does not block the intruder. It records them for later. Reflex: if the control finds the problem after the fact instead of preventing it, it is detective.

Tabletop exercises test decisions, not systems. The team talks through a breach on paper. No live network, no real attack, just the plan under pressure. Reflex: if nobody touches a keyboard and it is all discussion, it is tabletop.

98 of 121 Security+ videos completed. Only 23 remain. I have also finished reviewing Domains 1, 2 and 3. Tomorrow, I officially begin Domains 4 and 5. The final stretch starts now.