Practical SOC guides
Short, field-tested write-ups for analysts, IT admins and MSPs: what an alert or record means, how to investigate it, and how to fix it. Each one links to a free tool that does the tedious part.
Windows Event ID 4625: failed logons explained and how to investigate
What Windows Security Event 4625 means, how to read the logon type and status codes, how to tell brute force from password spraying, and what to do next.
7 min read →Windows logon types explained (Event ID 4624): what each one means for security
Every logon type in Event ID 4624 and 4625, from 2 to 13, with what it looks like in normal use and which ones point to RDP abuse, lateral movement or pass-the-hash.
6 min read →How to read email headers to spot phishing and spoofing
Where to find full email headers in Outlook, Gmail and Microsoft 365, how to read Received lines, SPF, DKIM, DMARC and compauth results, and the red flags of spoofing and business email compromise.
8 min read →DMARC from p=none to p=reject: a safe step-by-step rollout
How to move a domain's DMARC policy from monitoring to quarantine and reject without blocking your own email: inventory senders, fix SPF and DKIM alignment, read reports and ramp up.
8 min read →SPF permerror: too many DNS lookups (the 10-lookup limit) and how to fix it
Why SPF records break when they need more than 10 DNS lookups, what counts toward the limit, and five safe ways to get back under it without losing legitimate mail.
5 min read →Microsoft 365 impossible travel alert: how to investigate and respond
What triggers impossible travel and atypical travel alerts in Microsoft 365 and Entra ID, how to rule out VPN false positives, the sign-in log fields to check, and the response steps when it is real.
7 min read →