RESEARCH / FIELD NOTES / METHODS

Understand behavior.
Follow the evidence.

Clear, practical research notes for detection engineering and digital investigations.

Detection Engineering6 min read

A detection design approach that considers the data source, normal behavior and validation conditions together.

Splunk SPL · Telemetry

DFIR6 min read

Read task definitions, file and registry artifacts, event records and execution evidence together.

Windows · Scheduled Tasks

SOC Operations5 min read

A systematic investigation from the alert title to source evidence, asset context and a documented decision.

SOC · SIEM

Threat Hunting5 min read

Move from a testable behavioral hypothesis to data coverage, candidate review and a bounded conclusion.

Threat Hunting · Hypothesis

Understand behavior.Follow the evidence.