Blue Team Operations

Intermediate · 12w

Detection engineering, log analysis and incident response, built on the telemetry regional organisations actually have rather than the stack a vendor would sell them.

#	lessons	min
01	Getting signal out of what is already running	30
02	Writing detections that fire on behaviour, not filenames	30
03	Finding the one session that matters in a week of noise	35
04	The first four hours, and the decisions that cannot be undone	35
05	Evidence that survives contact with a lawyer	35