Incident Analysis
In-depth guides and analysis on incident analysis from the Safeguard engineering team.
100 articles
What are indicators of compromise and how do you use them?
Indicators of compromise are observable traces of a breach. Learn the common types, why they go stale, and how to use them without drowning in noise.
Which cyberattacks are best documented, and what do they teach?
NotPetya, SolarWinds Orion, the 2015 Ukraine grid attack and the Colonial pipeline ransomware are documented by CISA. Here is what each teaches defenders.
What is a watering hole attack and how do you defend against it?
A watering hole attack compromises a site a target group already visits. See how it works, how it differs from phishing, and which defenses actually help.
What was the WannaCry ransomware attack and what should we learn?
WannaCry spread on 12 May 2017 through a Windows SMB flaw that had a patch two months earlier. The lesson is about patch speed and exposed services.
What are the main types of ransomware and how do they differ?
Ransomware comes as encryption only, double extortion with data theft, and data extortion without encryption. See how each works and which defenses apply.
What Are the Main Types of Business Email Compromise (BEC) Scams?
BEC tricks staff into sending money or data by impersonating or hijacking trusted email accounts. Learn the common patterns and the checks that stop them.
What are the lessons from the July 2024 faulty update outage?
A faulty security content update crashed Windows hosts on 19 July 2024. Learn three lessons: stage vendor updates, control rollout, and rehearse recovery.
What is threat detection and response and how do you build it?
Threat detection and response means finding likely attacks fast and acting on them. Plan it with NIST CSF Detect, Respond, Recover and MITRE ATT&CK.
Ten ransomware defenses that matter, based on the CISA guide
Offline backups, tested recovery, patching exposed systems, MFA, no open RDP and a rehearsed plan. Ten ransomware defenses drawn from the CISA guide.
What was Spring4Shell (CVE-2022-22965) and who was affected?
Spring4Shell was a critical Spring Framework flaw in data binding on JDK 9 and later. See who was affected, the fixed versions and how to check builds.
What Are the Roles and Responsibilities in a SOC?
A SOC splits work among alert analysts, responders, hunters, detection engineers and a manager. See who owns which task and where handoffs fail.
What is the difference between SOAR and SIEM?
A SIEM collects and correlates logs to detect trouble. A SOAR runs response steps from playbooks. They work as a pair, and here is how to tell them apart.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.