← Blog // TAG

Blue Team

7 articles

Blue Team SOC triage: the first 15 minutes of an alert A method to avoid drowning in alerts: validate, enrich, scope and decide. The steps and tools to go from "an alert fire… Read → Blue Team Hardening SSH: a practical checklist against brute force and unauthorized access SSH default config is a magnet for brute force. Keys instead of passwords, no root, 2FA, modern ciphers and monitoring,… Read → Blue Team Which CVE to patch first: prioritize with EPSS, KEV and context CVSS alone is not enough to prioritize patching. How to combine EPSS (exploit probability), CISA's KEV list and your re… Read → Blue Team How to analyze a phishing email (.eml) step by step A triage guide for a suspicious email without opening links or attachments: headers, SPF/DKIM/DMARC authentication, sen… Read → Blue Team SPF, DKIM and DMARC in practice: stop your domain from being spoofed A practical guide to setting up email authentication (SPF, DKIM and DMARC) in the right order, with the common mistakes… Read → Blue Team Hardening Microsoft 365 against phishing: the controls that actually matter Practical setup of Defender for Office 365, Conditional Access and email authentication (SPF/DKIM/DMARC), in the order … Read → Blue Team Detecting DNS Tunneling with KQL in Microsoft Sentinel Three KQL signals (entropy, volume and record types) to hunt DNS exfiltration and C2, and how to turn them into an anal… Read →