Opening the year
First Monday back at the desk. The shape of the year ahead and the four engagements already on the books.
End of 2012
The Christmas-and-new-year week is, for once, quiet. Boring is what the SOC is supposed to look like during a quiet period.
Eight weeks in
Eight weeks of running monitoring engagements. What it has taught us about detection-content tuning, OSSEC deployment friction, the value of Bro at the application layer, and the calibration of analyst attention.
Detection content
Six weeks of writing detection content for the Hedgehog SOC build. The technical innovation pool is shallower than the press coverage suggests; six categories cover most of what shows up.
Hedgehog SOC
The Hedgehog SOC decision has finally landed. Two analysts come in over the next two months, the Stafford office is being kitted out from next week. What tipped it, what the design constraints are, and what I am specifically not committing to.