SSH brute-force investigation
Linux authentication, five-minute windows, source addresses, and successful-login evidence.
INVESTIGATIONS & SOC PLAYGROUNDFollow the signal.
Follow the signal.
Explain the evidence.
Personal lab work and learning exercises. Completed practice and developing builds are labelled individually.
THE LAB / FOUR LAYERSA system to learn.
A system to learn.
A place to investigate.
Click a layer to see its purpose and the evidence it contributes. This is an illustrative topology, not a live monitoring feed.
Lab context: MacBook Air · UTM / VMware · ARM Windows and Linux. Sensor position and platform support affect available evidence. The broader network pipeline and DFIR workflows remain in development.
SIX CASE FILESQuestions first.
Questions first.
Tools in context.
Read each method, query, interpretation, and decision principle. Illustrative queries require tuning for the actual data.
Password-spraying analysis
Separate failure volume from account breadth, then investigate any successful access.
From syslog to Sentinel
Azure Arc, AMA, DCR, Windows and Linux ingestion, and authentication analytics.
Endpoint visibility with Defender
Windows and Ubuntu onboarding, sensor health, reporting, and investigation context.
The network leaves clues
Zeek connections and DNS, OPNsense segments, Suricata, and the SIEM pipeline.
Go beyond the alert
Velociraptor deployment and Linux authentication-artifact practice.