Journal · Reading path
Detection and response notes
Wazuh, SOCFortress CoPilot, Splunk and a simulated case I walk through step by step.
Ordered as a reading path, not by date.
Designing a SIEM path from Windows events to a CoPilot case
The detection design I am building toward: how a failed logon on a Windows endpoint would travel through Wazuh into a SOCFortress CoPilot alert and case, and what I check at each hand-off.
Asking Splunk and Defender for Endpoint the same question
I explored an additional Splunk instance alongside a Microsoft Defender for Endpoint free trial. Looking at one redacted scenario from both sides shows what each data source reveals and what it misses.
Working a simulated SOC case with a bounded AI step
How I use AI agents to speed up the tedious parts of SOAR work, gathering, normalising, grouping and drafting, and where the playbook stops them so a person makes the call. Walked through on a simulated case.
