ISC2 CC | Building toward Tier 1 SOC and Detection Engineering | Hands-on investigations with Splunk, Wazuh and Sigma | Documenting what I learn
Johannesburg, South Africa
- Tweets 25,323
- Following 1,475
- Followers 2,610
- Likes 30,106
I’m building in public toward Tier 1 SOC and Detection Engineering roles.
I share:
Home lab builds
Alert triage and investigations
SIEM, EDR and network telemetry
Detection logic and troubleshooting
No production claims. Just evidence of what I’m learning, testing and building.
9
15
149
5,992
Cybersecurity community, let’s connect!
SOC Analysis
Detection Engineering
Threat Hunting
DFIR
Incident Response
Malware Analysis
Ethical Hacking
Cloud Security
Penetration Testing
AppSec
DevSecOps
Red Teaming
Blue Teaming
AI Security
I want more of you on my timeline.
1
1
3
50
William | SOC and Detection Engineering retweeted
At CybariK, we work closely with organisations to build stronger, more resilient security foundations.
Through tailored consulting, audits, risk assessments, compliance guidance, talent solutions, and hands-on training, we support you every step of the way.
1/3
1
5
8
774
William | SOC and Detection Engineering retweeted
My name is Iretioluwa Akerele, I am the Director at CybariK Limited. Today is a good day to tell your organization about us. Let’s support them to strengthen their Cybersecurity posture 💜
At CybariK, we work closely with organisations to build stronger, more resilient security foundations.
Through tailored consulting, audits, risk assessments, compliance guidance, talent solutions, and hands-on training, we support you every step of the way.
1/3
2
14
35
3,174
Two laptops connect to the same WiFi.
How does the network tell them apart?
Each network interface has a MAC address.
Switches use MAC addresses to deliver data within a local network.
Security tip: A MAC address can be spoofed.
Never rely on it alone to verify a device.
3
35
William | SOC and Detection Engineering retweeted
Cyber defense isn't about mastering one tool.
Different threats require different tools.
Wireshark inspects traffic.
Snort detects threats.
TheHive manages incidents.
Defender investigates endpoints.
The real skill is knowing which tool provides the evidence you need.
2
6
190
I can’t wait to start my 90 Day SOC journey completely from scratch!
90 days of building, investigating, making mistakes, and learning to think like a SOC analyst.
I’ll be documenting the wins, challenges, and lessons along the way.
Curious to see how far I can grow!
2
9
201
Cyber Awareness Day 20
I expected process creation, command line details and an alert.
The test ran, but some telemetry was missing.
That gap matters.
I am learning to compare expected results with actual evidence.
A detection firing does not guarantee complete visibility.
1
5
161
William | SOC and Detection Engineering retweeted
Someone reading this is waiting for a job offer, an interview result, a business opportunity, or an important approval.
I hope the next message you receive brings the good news you've been waiting for.
2
3
12
281
William | SOC and Detection Engineering retweeted
My Windows 11 client was joined to corp.local.
But what security activity was DC01 configured to record?
Part 29 of rebuilding my SOC home lab.
I moved from domain integration to verifying Group Policy and audit settings on my Domain Controller.
2
3
12
257
William | SOC and Detection Engineering retweeted
Linux security investigations start with knowing where to look.
ss reveals listening ports.
last shows login history.
sha256sum checks file integrity.
lsof links connections to processes.
journalctl reveals system errors
The goal isn't memorizing commands. It's finding evidence
3
4
148
William | SOC and Detection Engineering retweeted
I love this language ❤️😊
A SIEM alert is a starting point, not a verdict.
A detection rule identifies activity that matches certain conditions.
But context determines whether it’s:
• Legitimate activity
• A false positive
• Suspicious behavior
• A confirmed security incident
Never investigate an alert in isolation.
1
3
8
201
William | SOC and Detection Engineering retweeted
An unfamiliar IP address appears in your security logs.
Is it an attacker?
Not necessarily.
An IP address helps identify where network traffic comes from or goes.
SOC tip: Check its reputation and activity before investigating further.
Context matters.
106
William | SOC and Detection Engineering retweeted
ICYMI
Studying or planning for the Cysa+? Watch this for a honest breakdown of what it actually tests, whether it was worth it, and the exact resources I used to pass it 👀
RT's and likes appreciated 🤝
I Got My CySA+ as a Tier 2 Analyst (Here’s How It Went)
piped.video/FWYYzR5QPqo
1
5
170
A SOC analyst's job doesn't end when an alert appears.
Was it malicious?
Which systems were affected?
What evidence supports escalation?
Blue team work goes beyond watching alerts. It's about connecting evidence, understanding threats and making defensible decisions.
1
8
244
I wanted to investigate security alerts.
But first, I needed to understand the infrastructure producing them.
30 parts later, my SOC home lab rebuild series ends.
Here's why I chose to build the foundation before focusing on detections.
1
8
189
A failed login means more when you understand authentication.
A suspicious account change means more when you understand Active Directory.
Missing security events mean more when you understand auditing.
SOC investigations need context, not just alerts.
1
19