Incident Analysis
In-depth guides and analysis on incident analysis from the Safeguard engineering team.
100 articles
How Do Command and Control (C2) Attacks Work and How Do You Spot Them?
Command and control is how an attacker talks to a compromised machine. MITRE lists 18 techniques. Learn what to hunt for in DNS, proxy and endpoint logs.
What Is Cloud Detection and Response (CDR) and What Should It Watch?
Cloud detection and response means spotting attacker activity in cloud control planes and identity logs, then acting. Learn the first sources to cover.
What should a CISO do first when ransomware hits?
Follow the approved plan: isolate affected systems, preserve evidence, engage legal and responders, and decide communications. Based on the CISA guide.
What is business email compromise and how do you stop it?
Business email compromise tricks staff into sending money through fake or hijacked email. Verify payment changes by a second channel and secure mailboxes.
Which tools and technologies help prevent BEC?
BEC defense mixes email authentication (SPF, DKIM, DMARC), MFA, mailbox monitoring and payment controls. Here is what each does and what it misses.
How do you use the Apple unified log for incident response?
On a Mac, collect a logarchive first, then query it with log show and predicates. Scope by time, process and subsystem to keep evidence and find signal.
How did the 3CX supply chain attack reach its customers?
Mandiant traced the 2023 3CX compromise to a trojanized trading app installer, then a poisoned desktop client. The chain, and what vendors should check.
What if the CVE program stopped? A preparedness checklist
The CVE program has faced funding scares. If identifiers stopped, advisories would not vanish. A checklist for sources, inventory and your own finding ids.
Uber 2022 breach, ten control checks to run against your own org
Uber's account of its 2022 incident points to MFA prompts, contractor accounts and internal tools. Ten checks to see if your org would catch the same path.
Triton/Trisis timeline, the malware built to attack a safety system
Triton, also called Trisis or HatMan, targeted Triconex safety controllers. A sourced timeline from the 2017 analyses on, and what defenders should learn.
Triton/Trisis defender checklist for industrial safety systems
A twelve point checklist to see if your plant would notice Triton style activity on a safety system, covering network, workstations, firmware and response.
SolarWinds Orion compromise: what happened and what defenders should learn
A timeline of the SolarWinds Orion supply chain compromise from CISA records, plus five lessons on build trust, identity and detection for defenders.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.