Windows Events, Sysmon and Elk…oh my! (Part 2)

Part one of a Windows monitoring series: installs ELK on Ubuntu with a ready-made script, fronts Kibana with Nginx for basic auth, and prepares the groundwork for Winlogbeat event collection.

A SIEM log curation checklist: nine log source categories ranked by investigation value into tiers, guiding parser work, retention spending, and detection engineering.

Part 3 of the red teaming series: joint red/blue debriefs, blameless post-mortems, and shared processes turn exercise findings into lasting security improvements.

Lessons from NetSPI's cloud attack simulations: default cloud logging alone is insufficient, SIEM rules need tuning, and breach and attack simulation (BAS) helps validate detective controls in Azure.

A curated list of 17 resources for aspiring defensive AppSec engineers, spanning security fundamentals, web application basics, hands-on practice, continuing education, and professional organizations.

NetSPI advises CISOs preparing for a red team exercise, covering objective alignment with program maturity, how much notice to give the blue team, and what takeaways to expect.