The publication
About The Incident Ledger
Security explained calmly, for the people who do the work.
The Incident Ledger is an independent technical publication for junior SOC analysts and for IT professionals moving into security. It exists because most security writing assumes you already know the field, while most beginner material stops before the part where you open a real console and investigate a real alert.
What we publish
- Tutorials: step-by-step investigations and configurations you can follow in a real tenant, with the queries and commands included.
- Threat analysis: attacks and incidents explained for beginners, with what they look like in your logs and how to stop them.
- Certifications: study plans and guides for exams such as SC-200, SC-900 and Security+.
- Tools: how to use and compare the tools a SOC analyst works with every day.
- The glossary: short, plain-English definitions of the terms you will meet in alerts, reports and job descriptions.
How we write
Every article is written by people who work in security, and every tutorial is tested before it is published. We prefer showing the actual query, the actual log field and the actual decision over general advice. When something changes, we update the article and say so at the top. Our editorial policy explains the process in detail.
What this is not
The Incident Ledger is not a news site and does not chase every headline. It is not a vendor blog either: no company pays for coverage, and products are mentioned only when they help you understand or do the work.
Why no author names
The articles are signed by the publication rather than by individuals. Trust here comes from the process, not from a byline: tested steps, sources you can check, visible review dates and a public record of corrections.