ISC2 CC | Building toward Tier 1 SOC and Detection Engineering | Hands-on investigations with Splunk, Wazuh and Sigma | Documenting what I learn
Johannesburg, South Africa
Joined March 2020
- Tweets25.9K
- Following1.5K
- Followers2.7K
- Likes31.2K
Ping works. The website still fails.
The OSI model separates communication into seven layers, helping you narrow the problem.
IP reachability does not prove the web service works.
Test the failing service before declaring the connection healthy.
William | SOC and Detection Engineering retweeted
How much cybersecurity risk is your organization willing to accept?
That is risk appetite.
A bank may accept minor website downtime but have very little appetite for exposing customer data.
The lesson?
Not every risk deserves the same response. Business priorities matter.
William | SOC and Detection Engineering retweeted
AI won't replace SOC analysts.
It will replace the ones who only close tickets.
Those are not the same job, and the difference is about to matter a lot.
William | SOC and Detection Engineering retweeted
No days off. 💪🏾
Discipline over motivation. Every single day.
Installing security controls doesn't eliminate every risk.
The risk that remains after controls are applied is called residual risk.
For example, MFA reduces account compromise risk, but phishing can still succeed.
GRC lesson: Measure what's left, not just what's protected.
William | SOC and Detection Engineering retweeted
5 Linux logs every SOC analyst should know
/var/log/auth.log → Login activity
/var/log/syslog → System events
/var/log/kern.log → Kernel messages
/var/log/audit/audit.log → Audit events
/var/log/secure → Authentication logs (RHEL)
Know where to look before investigating
William | SOC and Detection Engineering retweeted
Cyber Awareness Day 27
"Suspicious activity investigated. Escalated."
That tells the next analyst almost nothing
A good SOC report explains what triggered the alert, what was verified, what remains unknown and why it was escalated
Document your reasoning, not just your actions
William | SOC and Detection Engineering retweeted
5 Sysmon Event IDs every SOC analyst should know.
1 → Process creation
3 → Network connection
7 → Image loaded
11 → File created
22 → DNS query
Use them to trace what ran, what connected, and what changed.
Collecting logs is step one. Correlating them is the skill.
5 Sysmon Event IDs every SOC analyst should know.
1 → Process creation
3 → Network connection
7 → Image loaded
11 → File created
22 → DNS query
Use them to trace what ran, what connected, and what changed.
Collecting logs is step one. Correlating them is the skill.
A stolen password shouldn't be enough to access your account.
That's why MFA matters.
It adds another verification factor beyond your password.
But not all MFA is equal.
Passkeys and security keys offer stronger phishing resistance than SMS codes.
Cyber Awareness Day 27
"Suspicious activity investigated. Escalated."
That tells the next analyst almost nothing
A good SOC report explains what triggered the alert, what was verified, what remains unknown and why it was escalated
Document your reasoning, not just your actions
William | SOC and Detection Engineering retweeted
ICYMI
New video!
RT's and likes appreciated 🤝
Is Your SOC Job a Dead End? Here’s What’s Next
youtu.be/ej_YPIPCYZU
My Ubuntu VM crashed in UTM.
I rebuilt it from scratch and documented the journey to reconnect it to Splunk Enterprise.
Now I can search audit activity from that endpoint in my SIEM.
Here's the workflow I followed and what someone building a SOC lab can learn from it.
My final Splunk search:
index=main host=ubuntu sourcetype="linux:audit" "identity_changes"
It returned 2 records:
A successful chmod operation and an audit configuration change.
This confirmed that the specific Ubuntu audit activity was searchable in Splunk.