Windows Events, Sysmon and Elk…oh my!

Walks through building a Windows Event Forwarding collector, deploying Sysmon and WEF subscriptions via GPO, and piping forwarded events into ELK with Winlogbeat for centralized monitoring.

A SIEM log curation checklist: nine log source categories ranked by investigation value into tiers, guiding parser work, retention spending, and detection engineering.

Part 3 of the red teaming series: joint red/blue debriefs, blameless post-mortems, and shared processes turn exercise findings into lasting security improvements.

Lessons from NetSPI's cloud attack simulations: default cloud logging alone is insufficient, SIEM rules need tuning, and breach and attack simulation (BAS) helps validate detective controls in Azure.

A curated list of 17 resources for aspiring defensive AppSec engineers, spanning security fundamentals, web application basics, hands-on practice, continuing education, and professional organizations.

NetSPI advises CISOs preparing for a red team exercise, covering objective alignment with program maturity, how much notice to give the blue team, and what takeaways to expect.