Detection and blue team
What Is a SIEM? Logs, Queries and Alerting
A SIEM collects logs, normalizes them, runs correlation rules and raises alerts for triage. Learn the pipeline with a runnable example.
Beginner13 min read
Detection and blue team
Logs, alerts, Sigma rules and the investigation that turns an event into a finding.
Detection and blue team
Windows Event Logs and the Event IDs Defenders Use Most
Read the Windows Security log: audit policy, event IDs 4624, 4625, 4634, 4672, 4688 and 1102, what Sysmon adds, and a failed logon you find yourself.
Beginner12 min read
Detection and blue team
Writing a Sigma Rule: Your First Detection, Tested
Write a Sigma rule for failed Windows logons, validate it, convert it to Splunk, and test it against known-good and known-bad events.
Intermediate14 min read
Ask anything your scope allows.
Create an account, add credits from $10 and ask the first question in the chat or the terminal.
- 1/3
Create the account
Individual or company. You can switch to a company later without losing balance or keys.
IndividualCompany - 2/3
Add credits
By card, from $10. Pay per token, no subscription.
$10.00minimum deposit - 3/3
Ask
In the chat, or install the CLI and run notholy login in your terminal.
$ notholy login