The sheets
Eight references · updated as I use them
LogName='Security'; Id=4688 }
# process creation, last 24h
PowerShell
Host triage, event-log hunting, the IDs worth memorizing, and the Microsoft 365 / Entra ID checks for BEC — inbox rules, forwarding, OAuth grants, sign-ins.
--sort=start_time
# parent PID + full command line
Bash
Linux host triage from a shell: what's running, who's talking to what, persistence in cron and systemd, file carving, and remote evidence collection over SSH.
END { for(k in c) print c[k],k }'
# top 4xx/5xx sources
awk
The language in one screen, then the log-analysis one-liners — counting with arrays, brute-force detection, per-hour bucketing, and two-file IOC matching.
2. user & permissions?
# 12 questions → ticket note
Alert Triage
The questions to answer before you call an alert — scope, severity, MITRE, containment, host behavior, OSINT. Fill it in and copy a ready-made triage note.
2>/dev/null | grep deleted
# fileless processes still running
Linux Compromise
Compromise assessment on a Linux host — the Big Five (processes, directories, files, users, logs) from Sandfly's cheat sheet, plus network, persistence, and rootkit checks.
404 Not Found 429 502
# every code, grouped by class
HTTP Status Codes
The full set, color-coded by class, with log-triage notes on the codes that flag scanning, brute force, and abuse in access logs.
| groupBy([DomainName], function=[count()])
# base search, groupBy, hunting
CrowdStrike CQL
Falcon LogScale / Next-Gen SIEM query language — the repeatable base search, filtering, groupBy, time, and worked hunting queries.
3 Net · 2 Link · 1 Phys
# OSI ↔ TCP/IP, per-layer examples
Network Layers
The OSI seven-layer stack mapped to TCP/IP, with the protocols, devices, and the attacks and tooling that live at each layer.
Analyst tools
External · opens in a new tab