Eight weeks in
Eight weeks of running monitoring engagements. What it has taught us about detection-content tuning, OSSEC deployment friction, the value of Bro at the application layer, and the calibration of analyst attention.
Eight weeks of running monitoring engagements. What it has taught us about detection-content tuning, OSSEC deployment friction, the value of Bro at the application layer, and the calibration of analyst attention.
The Hedgehog SOC decision has finally landed. Two analysts come in over the next two months, the Stafford office is being kitted out from next week. What tipped it, what the design constraints are, and what I am specifically not committing to.