Y

SIEM and security operations · Beginner · 8 h

Logs, alerts and detections

Reading authentication logs, separating internet noise from a real attack, triaging an alert, and writing detections as Sigma rules and correlations.

Why employers care: SOC analysts spend their day triaging alerts and hunting in logs. Interviews often give you a log sample and ask what happened.

In the roadmaps for: Cybersecurity Engineer

Lessons, in order

  1. Reading authentication logs and triaging an alertTell internet background noise from a real break-in in an SSH log using grep, and follow a triage routine that ends in a clear decision.5 min
  2. Detection as code with SigmaWrite a Sigma rule, convert it to SQL automatically, and add a correlation that finds a successful login after password guessing.4 min