Security operations
Detecting and responding to attacks: detection rules, SOC triage, phishing and email analysis, forensics, threat hunting, incident playbooks, vulnerability management and CTF practice.
Download all 66
- Analyse DNS logs for command and control
Analyses DNS query logs for beaconing, DGA domains, DNS tunnelling and rare new domains, with queries for your platform and the benign patterns to rule out first.
- Analyse raw email headers
Analyses raw email headers for the delivery path, SPF, DKIM and DMARC results, alignment, spoofing signs and relay anomalies, explaining each finding in plain words for analysts and support staff.
- Analyse a suspicious Office or PDF document
Analyses a suspicious Office, RTF or PDF attachment statically for macros, remote templates, embedded objects and exploit traits, extracting defanged indicators and a verdict.
- Analyse a memory image with Volatility
Guides memory forensics with Volatility 3 on a captured Windows or Linux image, choosing plugins, reading process, network and injection findings and keeping an evidence log.
- Analyse a packet capture summary
Analyses a packet capture summary from a tool's output to identify protocols, suspicious connections, beaconing and data transfer patterns, and suggests filters and checks to inspect next.
- Analyse a suspicious script for defenders
Explains what a suspicious script or obfuscated command does for defenders, deobfuscating step by step, extracting defanged indicators and rating risk, without improving or weaponising it.
- Analyse web server logs for an attack
Analyses web server or load balancer access logs during a suspected attack, separating scanner noise from real exploitation, judging what may have succeeded and listing defanged indicators and checks.
- Assess ransomware readiness
Assesses how ready an organisation is to prevent and recover from ransomware - backups, restores, identity, exposure, admin access, detection and response - and gives a ranked fix list.
- Assess the impact of a vendor's breach
Works out what a supplier's security breach means for you - the access and data they held, secrets to rotate, activity to hunt for, questions to ask them and obligations to check.
- Build a forensic timeline
Builds a forensic timeline from parsed host and log artefacts, normalising time zones, correlating events, separating attacker actions from normal activity and listing evidence gaps.
- Clean up a hacked WordPress site
Cleans a compromised WordPress site step by step, finding injected code, rogue admins and backdoors, restoring from trusted sources, rotating secrets and closing the way in.
- Coach a CTF challenge
Coaches a learner through an authorised capture-the-flag challenge with graded hints, asking what they have tried and teaching the underlying concept and its defence without handing over the flag.
- Contain a compromised endpoint
Plans containment of one infected laptop or server - isolation options, evidence first, account and token resets, scope checks, user communication and the reimage decision.
- Define security incident severity levels
Defines security incident severity levels with criteria, worked examples, response times, who is paged, and when legal, leadership, communications and insurers must be told.
- Design a SOAR automation playbook
Designs a security automation playbook for one alert type, with enrichment, decision logic, human approval gates before disruptive actions, failure handling and metrics, ready to build.
- Detection engineer
Acts as a detection engineer who writes detections as code, tests them against real and synthetic data, tunes false positives and tracks coverage against attacker techniques.
- Hunt for web shells
Plans and runs a hunt for web shells on web servers using deployment diffs, suspicious code patterns, access log anomalies and web server process trees, with safe handling of hits.
- Investigate a CI/CD compromise
Investigates a suspected CI/CD compromise such as a tampered action, a malicious pull request run or a leaked runner token, scoping exposed secrets, builds and releases and the rotation order.
- Investigate cloud audit logs
Investigates AWS, GCP or Azure audit logs for suspicious activity such as new access keys, privilege changes, unusual regions, logging tampering or data exports, and recommends containment steps.
- Investigate a compromised mailbox
Investigates a suspected compromised email account for inbox rules, forwarding, OAuth grants, persistent sessions and fraud sent from it, then plans containment and scoping.
- Investigate a container runtime alert
Investigates a container or Kubernetes runtime alert such as a shell in a pod, an unexpected binary or a privileged pod, with kubectl checks, evidence-safe containment and credential scope.
- Investigate suspected insider data theft
Plans an authorised investigation into suspected data theft by an employee or leaver across email, cloud storage, USB, SaaS and endpoint logs, with HR and legal coordination and fairness checks.
- Investigate a reported phishing email
Investigates a phishing email reported by staff - extracts defanged indicators, reaches a verdict, scopes who received, clicked or replied, and lists blocking, reset and user communication steps.
- Investigate a risky sign-in alert
Works through an identity alert such as impossible travel, MFA push spam or a sign-in from a new country, tests the benign explanations and reaches an evidenced verdict with next actions.
- Investigate SSH login activity
Reads SSH authentication logs to separate background brute-force noise from real successful or suspicious logins, checks key fingerprints and sessions, and recommends hardening.
- Investigate a suspicious domain or URL
Investigates a domain or URL with registration, DNS, certificate transparency, hosting and reputation data plus internal sightings, and decides block, monitor or benign.
- Investigate Windows event logs
Investigates Windows Security, Sysmon and PowerShell logs for logons, process creation, lateral movement and privilege use, naming the event IDs that matter and what they cannot show.
- Investigate Windows persistence
Checks a Windows host for persistence in run keys, services, scheduled tasks, WMI subscriptions, startup folders and COM hijacks, and separates malicious entries from normal software.
- Map detection coverage to attack techniques
Maps an organisation's existing detections to attack techniques, finds coverage gaps for its threat profile and prioritises new detections by likelihood, impact and data availability.
- Map your external attack surface
Maps an organisation's internet-facing assets from DNS, certificates, cloud accounts and code, finds forgotten or risky exposures such as dangling DNS, and assigns owners and fixes.
- Plan forensic evidence acquisition
Plans how to collect digital evidence from suspect systems before it is lost - order of volatility, memory, disk, cloud snapshots and logs, hashing, chain of custody and what not to touch.
- Plan a honeytoken deployment
Plans decoy credentials, files, accounts and canary tokens placed where only an intruder would touch them, with alert routing, false-trip risks, safety rules and a test and upkeep plan.
- Plan security log source onboarding
Plans which security logs to collect first, the fields and settings each needs, retention, parsing checks and silent-source monitoring, so investigations and detections have the data they need.
- Plan remediation after a penetration test
Turns a received penetration test report into a remediation plan with validated findings, re-rated risk, owners, deadlines, compensating controls, disputes and a retest scope.
- Plan a phishing simulation programme
Plans an ethical phishing simulation programme with approvals, scenarios by difficulty, cadence, report-rate metrics, supportive follow-up for clickers and honest reporting.
- Plan a purple team exercise
Plans an authorised purple team exercise that safely emulates chosen attacker techniques, measures whether each was logged, alerted, triaged and contained, and turns gaps into fixes.
- Plan a security tabletop exercise
Plans a security tabletop exercise with a realistic scenario, timed injects, roles, discussion questions, decision points, a facilitator guide and an after-action report template.
- Prioritise a vulnerability backlog
Prioritises a vulnerability scan backlog by severity, exploitation evidence, exposure and asset value, grouping fixes into patch waves with owners, deadlines and time-limited exceptions.
- Ransomware response track
Guides a team through a ransomware incident in gated steps - contain, preserve evidence, scope, choose a recovery path, restore safely, then communicate and learn - with decisions logged.
- Recover Active Directory after compromise
Plans recovering Active Directory after domain admin compromise, with out-of-band coordination, a persistence hunt, privileged credential resets, the double krbtgt reset and validation.
- Respond to a compromised dependency
Responds to news that a package you use was hijacked or backdoored, finding affected lockfiles, builds and machines, treating secrets as exposed where it ran, and pinning safe versions.
- Respond to a newly disclosed critical vulnerability
Plans the first days after a critical, possibly exploited vulnerability is disclosed - find exposure, mitigate, patch, check for compromise before the patch, and keep people informed.
- Respond to cryptojacking in the cloud
Responds to cryptomining found in a cloud account or cluster - preserve then stop the spend, sweep every region, find the entry point, remove persistence, rotate credentials and seek billing relief.
- Respond to an exposed database or bucket
Responds to a publicly exposed database or storage bucket - close access, preserve evidence, work out how long and who read it, scope the data and prepare the notification decision.
- Review firewall and security group rules
Reviews a firewall or cloud security group rule set for overly permissive, shadowed and unused rules, missing egress controls and documentation gaps, and plans a safe staged cleanup.
- SOC analyst
Acts as a seasoned security operations analyst who triages on evidence, documents everything, escalates early when impact is possible and stays calm under alert floods.
- Triage a compromised Linux server
Triages a Linux server you suspect is hacked, checking logins, SSH keys, cron, systemd, processes, connections and package integrity, then helps decide contain, clean or rebuild.
- Triage a DLP alert
Triages a data loss prevention alert by checking whether the matched data is really sensitive, whether the transfer fits the role and what intent signals exist, then closes, coaches or escalates.
- Triage a malware sandbox report
Reads a malware sandbox report to separate behaviours that matter from benign noise, extracts defanged indicators, says what the sandbox may have missed and gives a verdict with next steps.
- Triage a SOC alert
Walks a SOC analyst through triaging a security alert turn by turn, asking for the enrichment that matters, weighing benign explanations, reaching an evidenced verdict and writing the escalation note.
- Triage a suspicious executable
Triages a suspicious Windows or Linux executable with static checks - hashes, signature, packing, imports, strings and capabilities - and decides benign, suspicious or malicious and what to do next.
- Tune a noisy detection rule
Tunes one security detection that floods analysts with false positives, clustering the noise and proposing narrow exclusions that keep the true positives and do not hand attackers a blind spot.
- Tune WAF false positives
Tunes a web application firewall that blocks real users, finding the rules that fire, confirming the request is legitimate and writing the narrowest exclusion that does not open a hole.
- Turn indicators into blocks
Turns a set of indicators into blocks for firewall, DNS, proxy, email and EDR, with false-positive checks, a retro-hunt first, expiry dates, change records and rollback.
- Write a bug bounty report
Writes a clear bug bounty or disclosure report for an in-scope finding, with summary, affected asset, reproduction steps, honest impact, evidence and remediation in the programme's format.
- Write an incident response playbook
Writes an incident response playbook for one scenario, such as business email compromise or a lost laptop, with triggers, roles, containment, evidence, communication, recovery and review steps.
- Write osquery hunting queries
Writes osquery SQL to hunt across endpoints for persistence, odd processes, listening ports and rogue extensions, with expected baselines, stacking advice and safe scheduling.
- Write a security awareness module
Writes a short security awareness module for staff on one topic, such as phishing, MFA fatigue or safe file sharing, with realistic examples, clear actions, a quiz and a one-page reminder.
- Write a SIEM investigation query
Writes a SIEM or log query for an investigation question in the platform's query language, stating field assumptions, explaining each step, and adding performance tips and a way to validate results.
- Write a Sigma detection rule
Writes a Sigma detection rule from an attack behaviour or log samples, with log source, selection and filter logic, false-positive notes, ATT&CK tags and positive and negative test events.
- Write a SOC metrics report
Turns raw security operations data into an honest monthly or quarterly metrics report - detection and response times, alert quality, coverage and workload - for analysts, leaders or the board.
- Write a Suricata or Snort rule
Writes a Suricata or Snort network detection rule from traffic samples or a threat description, with sticky buffers, flow options, thresholds, false-positive notes and a pcap test plan.
- Write a threat hunting plan
Writes a hypothesis-driven threat hunting plan with data sources, queries to run, expected benign baselines, what a finding looks like and how to turn results into detections.
- Write a threat intelligence brief
Writes a threat intelligence brief from supplied reports, summarising the threat, its relevance to the organisation, defanged indicators, recommended actions and a stated confidence level.
- Write a vulnerability management policy
Writes a vulnerability management policy with scope, scan coverage, risk-based prioritisation, fix deadlines, exception and risk acceptance rules, owners, metrics and review.
- Write a YARA rule
Writes a YARA rule for a malware family or suspicious file pattern from defender-supplied indicators, balancing strings and conditions to limit false positives, with test and tuning guidance.
Not: building secure software, secure review and hardening (security); personal account safety (digital-safety); outages with no attacker (incident).