About

I’m a SOC analyst. My days: triaging alerts, investigating, writing detection rules… and wondering how an attacker would slip under the radar.

Why “Purple”?

The red team attacks, the blue team defends. Purple teaming means getting both to work together: replay an attack technique, check whether we see it, and improve detection until we do.

And “Log”, because everything always ends up in the logs.

What you’ll find here

• Detection rules (Sigma, KQL, SPL), explained and mapped to MITRE ATT&CK
• Anonymized investigation write-ups
• Labs to replay an attack and build the matching detection
• Thoughts on the analyst job

Disclaimer

Opinions are my own and do not reflect my employer’s. No customer data or internal information is ever published. Content is for educational and defensive purposes.

Contact

A comment, a correction, a rule that doesn’t work in your environment? Email me: chabnco@gmail.com.