Tag: SOC
-
The Simple Series: Python Tools for Blue Team Triage
Building detection tools before landing a security job is one way to close the experience gap. The Simple series came out of that approach. Three Python CLI tools, each solving a specific triage problem, each designed to be small enough to understand completely and useful enough to run against real data. Simple Phishing Analyzer Phishing…
-
Linux Security Monitoring with OpenSCAP and Splunk
A few months ago I started building out a home lab focused on detection engineering. This project covers Linux SIEM monitoring with Splunk and OpenSCAP on a hardened Ubuntu 24.04 VM with detections mapped to MITRE ATT&CK. The starting point is OpenSCAP, an open source tool that evaluates a system against a security benchmark and…