Similar Posts
Axonius — Tool Overview
What is Axonius? Axonius is a Cyber Asset Attack Surface Management (CAASM) platform that aggregates and correlates device and user data from across the organization’s existing security and IT tools. Rather than replacing existing tools, Axonius continuously normalizes, deduplicates, and enriches aggregated asset data to provide a complete and accurate picture of the entire technology…
False Positive vs. True Positive
The distinction between a false positive and a true positive hinges on a single question: Did the tool or rule do what it was designed to do? True Positive A true positive occurs when a rule fires correctly, in accordance with its defined logic and conditions. The detection behaved exactly as intended based on how…
Common Terms
Glossary of Security Terms and Definitions Objective: To standardize technical terminology within the Security Operations Center (SOC) and ensure accurate communication during endpoint investigations. 1. MD5 Hash (Message Digest Algorithm 5) A unique 32-character cryptographic string used to represent a file’s digital identity. It serves as a fixed-length “fingerprint” that remains constant regardless of file…
DomainTools — Tool Overview
What is DomainTools? DomainTools is a domain and DNS-based cyber threat intelligence platform used by security teams to investigate suspicious domains, IP addresses, and internet infrastructure. It enables security practitioners to stop threats before they happen using internet intelligence data, detection and monitoring tools, and predictive risk scoring. For SOC analysts, DomainTools is primarily used…
The Triple Punch
Standard Endpoint Investigation Workflow Objective: To determine if a file is safe or malicious, find out who has it, and confirm if security controls (Antivirus) took action. Punch 1: The Inventory Hunt (Scope & Presence) Punch 2: The Reputation Check (Global Intel) Punch 3: The Log Audit (Security Action) Investigation Summary Checklist
Cyber Analysis 102
Endpoint Analysis & Asset Investigation — L1 SOC Analyst Guide Overview This guide covers the initial steps for investigating endpoint alerts for the L1 Analyst onboarding. The focus is on determining whether a known malicious hash exists in the environment and identifying the affected device and its user. By the end of this section you…