Defensive Security Tutorial with Examples.
Defensive security tutorial: detection as code on logs you generate, from auth logs, Sigma rules and Suricata to alert tuning, incident response, YARA and DKIM.
Beginner
Start here — no prior experience needed
Intermediate
For developers with core concepts down
Sigma Detection Rules: Catch SSH Brute Force and Map It to ATT&CK
Write a Sigma rule for SSH password failures, watch a too-strict field match find nothing, fix it, add a brute-force correlation, map it to MITRE ATT&CK.
Suricata on a Packet Capture: Write an IDS Rule That Fires
Capture your own HTTP traffic, run Suricata 8 over the pcap with a local rule, and see why checksum offload and a port-80 rule both cause silent misses.
Alert Triage and Tuning: From 41 Alerts to the 3 That Matter
One noisy Suricata rule, 41 alerts and 38 of them benign. Triage by grouping, then tune with suppress and threshold, and measure what each change hides.
Incident Response: Preserve the Evidence, Then Contain
Collect a compromised container's processes, a deleted binary, file changes and an image, hash it all, isolate it, and see what stopping first loses.
Building an Incident Timeline from Auth, Web and IDS Logs
Merge SSH auth logs, a web access log and Suricata alerts into one UTC timeline in Python, and fix the timezone bug that puts an attack in the wrong order.
Static File Analysis with EICAR and YARA: Hashes, file, strings and Rules
Triage a suspicious file safely with sha256sum, file and strings, then write a YARA rule that matches the EICAR test file and not a note that mentions it.
Advanced
Production-grade patterns for experienced engineers
Also part of Defensive Security
Taught in other topics. Each link opens the lesson in its home topic.
A Firing Alert Doesn't Mean Anyone Was Notified
Prometheus evaluates alert rules and Alertmanager delivers notifications — two separate systems. A misconfigured link between them lets an alert fire silently forever, with real Prometheus and Alertmanager API output proving it.
MTTR Isn't a Guess — Compute It From Alertmanager's Own Timestamps
Every alert notification Alertmanager sends already carries the raw material for MTTR: startsAt and endsAt. Log them for real, compute a real mean-time-to-resolve, and see why the number it produces is longer than the actual outage.
Logging Security Events Without Logging Secrets
Log failed logins as JSON events, catch the bug that writes the password into the log, redact it, stop log injection, and alert on 5 failures in 60s.
Watching the TCP Handshake with tcpdump
Capture a real TCP connection with tcpdump in a Docker lab: SYN, SYN-ACK, ACK, the data, the FIN close, and the RST that makes Connection refused.
Host Firewalls with nftables: DROP Times Out, REJECT Refuses
Firewall a container's own port with nftables: a drop rule makes clients time out, reject makes them refused, and a source allow-list lets one host in.
Hunting in AWS CloudTrail Logs with Python
Search CloudTrail JSON with Python for root console logins, new access keys, IAM policy changes and public buckets, then build a sorted attack timeline.