A SOC investigation rarely starts with perfect evidence. Sometimes the analyst has a packet capture. Sometimes there are only flow records. Sometimes the most useful […]
Cybersecurity (200-201)
Cisco 200-201: Windows Event Logs for SOC Investigations
Windows produces enormous amounts of event data. A SOC analyst’s job is not to memorize every event ID. It is to recognize which events help […]
Cisco 200-201: Linux Logs for SOC Investigations
Linux does not give a SOC analyst one universal security log with identical paths on every distribution. Modern systems may use the systemd journal, traditional […]
Cisco 200-201: How to Spot DNS Tunneling in SOC Traffic
DNS is necessary for normal network operation, which makes it attractive to attackers. A host that is allowed to resolve names may also be able […]
Cisco 200-201: X.509 Certificates and TLS Key Exchange
TLS investigations become confusing when certificates, cipher suites, encryption algorithms, signatures, and key exchange are treated as one thing. They are related parts of a […]