Evidence · Playbooks

SOC field guide

What I actually did with Splunk, Microsoft Sentinel and Wazuh, on live data from my honeypot. Each number below comes from the tool itself (Azure's incident log, Splunk's audit index), not from me typing it in.

• 5verified playbooksSplunk / Microsoft Sentinel / Wazuh · queries