// notes, writeups and lessons from my learning journey
2026-09
Starting the Hack The Box SOC Analyst path on the way to the HTB Certified Defensive Security Analyst exam, my first official certification, and early impressions comparing TryHackMe's manual-first approach to HTB's AI-integrated one.
2026-08
Loading Splunk's BOTS v1 breach dataset into my own instance and working the investigation from scratch: a Joomla exploit, a living-off-the-land compile, and a Cerber ransomware detonation two weeks later, traced end to end with SPL.
2026-08
Trying to brute force a Windows box with Hydra from Kali, and what happened when RDP, SSH and SMB all refused to cooperate. How I still generated real Event ID 4625 data and built a working Splunk alert around it, silent cron failures included.
2026-07
A review of the TryHackMe AI Security path: the LLM threats, vector databases and RAG pipelines it covers, and why it mapped onto SOC thinking more neatly than I expected.
2026-07
Analysing real phishing samples end to end: checking URLs and IPs against threat intel, reading email headers, and the case that taught me why you don't blanket-block an IP.
2026-07
How I built a small home SOC lab from scratch: the architecture, the things that broke along the way, and the Splunk query that taught me what normal looks like.
2026-07
A beginner-friendly introduction to the MITRE ATT&CK framework: what it is, how tactics and techniques fit together, and why it's one of the most useful things to learn early in a SOC role.
2026-06
A look back at the SOC Level 1 learning path: what it covers, what surprised me, and tips for anyone starting it.