🎯 What You'll Learn
- Explain how a SIEM works
- Understand and onboard log sources
- Triage and investigate alerts
- Write basic detections
About This Workbook
Security operations centres are where detection happens day to day. This workbook covers SIEM concepts, log sources, and the analyst workflow of triage and investigation.
Chapter 1 — SIEM & Log Sources
The data and platform behind detection.
- What a SIEM does
- Key log sources
- Normalisation
Chapter 2 — The Analyst Workflow
Turning alerts into decisions.
- Triage
- Investigation
- Escalation
Chapter 3 — Detection Basics
Writing searches that find evil.
- Detection logic
- Reducing false positives
- Validation
Keep going. Work through each chapter in order, then apply what you learned in the matching labs.