Cybersecurity & Threat Defense Hub

Welcome to the Cybersecurity & Threat Defense Hub. Explore SOC alert triage, endpoint investigations, incident response, application security testing, and identity audits.

---

🗂️ Cybersecurity Knowledge Tracks

SOC & Alert Triage

Practical workflows for validating alerts, investigating Windows and Linux activity, and documenting decisions for the next analyst.

Triage a SOC Alert →
Investigate Windows Sign-In Activity →
Trace a Process with Sysmon →
Triage Linux SSH and Sudo Activity →
Build a Small SOC Lab with Wazuh →
Use KQL for First-Line Investigations →
Investigate Entra ID Sign-In Alerts →
Triage DNS and Outbound Traffic with Zeek →
Investigate a Microsoft Defender Endpoint Alert →
Triage a Phishing Email →

Threat Defense & Endpoint Telemetry

Endpoint telemetry, passive web testing, and collaborative host firewall remediation for authorized systems and labs.

Deploy Sysmon Telemetry →
Run the ZAP Passive Baseline Lab →
Use CrowdSec for Linux Firewall Remediation →
Write a Sigma PowerShell Detection →

Identity & Access Management

Review privileged directory access, use hardware-backed SSH security keys, and apply least-privilege administration.

Audit AD Privileged Groups →
Audit AD Certificate Services →
Use SSH FIDO2 Security Keys →
Grant Least-Privilege Linux Access →

Network Auditing & Recon

Documented asset discovery and limited service inventory within an explicitly approved scan scope.

Run an Authorized Nmap Discovery →

Incident Response

Collect a focused first-response snapshot on Linux and Windows, then preserve the evidence under your response process.

Linux First-Response Snapshot →
Windows First-Response Snapshot →
Volatile Memory Acquisition & Triage →
Hunting Windows Persistence Mechanisms →