Certifications
SC-200 study plan for SOC beginners
A six-week plan to prepare for Microsoft's Security Operations Analyst exam: what to study each week, how to practice for free, and the KQL you need to know.
· 3 min read
The Incident Ledger: practical security for people starting out
Threat Analysis
MFA fatigue attacks: how push bombing works and how to stop it
Why attackers flood users with MFA prompts until one gets approved, what the Uber and Cisco breaches teach us, and the controls that make push bombing fail.
Tutorials
Investigating a suspicious sign-in in Entra ID, step by step
What to check in the sign-in logs, which KQL queries to run, how to compare against the user's normal behavior, and when to revoke sessions and reset access.
Latest
Certifications ·
SC-200 study plan for SOC beginners
Threat Analysis ·
MFA fatigue attacks: how push bombing works and how to stop it
Tutorials
All tutorials →Investigating a suspicious sign-in in Entra ID, step by step
What to check in the sign-in logs, which KQL queries to run, how to compare against the user's normal behavior, and when to revoke sessions and reset access.
Threat Analysis
All threat analysis →MFA fatigue attacks: how push bombing works and how to stop it
Why attackers flood users with MFA prompts until one gets approved, what the Uber and Cisco breaches teach us, and the controls that make push bombing fail.
Certifications
All certifications →SC-200 study plan for SOC beginners
A six-week plan to prepare for Microsoft's Security Operations Analyst exam: what to study each week, how to practice for free, and the KQL you need to know.