Building a Mini SOC Lab: SSH Authentication Triage Using Journald and PythonOne of the main tasks I expect to handle as a SOC analyst is reviewing authentication logs -looking for failed login attempts, picking up on patterns like brute-force or username spraying, and figuring out whether something is just a user mistyping t...Jan 26 · 4 min readwizard-school.hashnode.dev
Asset Context and Alert Severity in ICS/OT: Why the Same Activity Can Mean Very Different Things(Follow-up to: “Observing Baseline vs Anomalous Modbus Traffic – A Beginner’s ICS/OT Security Lab”) Introduction In my previous lab, I focused on a foundational skill in ICS/OT security operations: establishing a baseline and identifying anomalous pr...Jan 21 · 5 min readwizard-school.hashnode.dev
Observing Baseline vs Anomalous Modbus Traffic: A Beginner’s ICS/OT Security LabIntroduction In support of my recent research into ICS/OT Security Operations, I wanted to set up a small, controlled environment where I could observe normal industrial network behavior identify meaningful deviations reason about that activity us...Jan 7 · 7 min readwizard-school.hashnode.dev
Lab Write-up: Putting Snort Skills into PracticeIn this lab exercise, I will be using my knowledge of Snort as learned in the previous TryHackMe module, to write rules and apply them in order to analyse, inspect, and block network traffic. Please note, in this blog post, I will be primarily focusi...Sep 3, 2025 · 4 min readwizard-school.hashnode.dev
