SOC & Blue Team articles
SIEM alerts, log analysis, triage workflows, and blue-team investigation
Learn security monitoring, alert triage, log analysis, SIEM operations, threat hunting, detection engineering, and incident response workflows.
Collection snapshot
—
Published articles in this collection
Best for: SOC analysts, detection engineers, and security monitoring teams
…
Published articles
8
Example topics
3
Learning paths
How to use this collection
Read → apply → reference
Each article is written as a practical knowledge block you can use on the job, in labs, or during audits.
Learn the concept
Understand the threat, control, or workflow with clear explanations.
Follow the checklist
Apply steps, commands, or evidence collection in your environment.
Connect to practice
Jump to related labs, tutorials, and tools to reinforce skills.
Example topics in this collection
- SIEM alerts
- Wazuh
- Splunk
- ELK
- Log analysis
- Incident triage
- Phishing investigation
- Threat hunting
Catalog
Articles in soc & blue team
Practical guides, checklists, and explainers focused on this security domain.
Outcomes
What you'll learn
- Triage alerts and investigate suspicious authentication and phishing activity
- Analyze logs from SIEM, EDR, and identity systems with structured workflows
- Document incidents with timelines, impact, and remediation steps
- Prepare for SOC interviews and blue-team career progression
More topics
Explore other article collections
Jump between fundamentals, offensive security, blue team, cloud, compliance, and more.
Cybersecurity Fundamentals
Core security concepts, threat models, and the mindset every defender needs
View collectionEthical Hacking & Penetration Testing
Recon, testing workflows, exploitation basics, and professional reporting
View collectionWeb Application Security
OWASP risks, injection flaws, access control, APIs, and secure development
View collectionLinux Security
SSH hardening, permissions, auditd, firewalls, logging, and CIS controls
View collectionIncident Response
Detect, contain, investigate, eradicate, recover, and learn from incidents
View collectionCloud Security
IAM, logging, network controls, storage security, and misconfiguration detection
View collectionDevSecOps
Secure CI/CD, secret scanning, SAST/DAST, containers, and pipeline automation
View collectionCompliance & GRC
Frameworks, controls, audit evidence, policies, and GRC workflows
View collectionSecurity Tools & Platforms
Practical guides for scanners, SIEM, testing, and investigation platforms
View collectionNetwork Security
Segmentation, firewalls, VPNs, DNS, IDS/IPS, and packet analysis
View collectionCryptography
Encryption, hashing, TLS, certificates, signatures, and key management
View collection