Hands on experience investigating real alerts across CrowdStrike, Microsoft Sentinel, Splunk, Wazuh, and LimaCharlie.
I built the SOC Workflow App to keep my own investigations structured — every alert worked the same disciplined way, from first alert to final recommendation.
Built on the NIST Incident Response framework, turned into a step by step process for working CrowdStrike alerts. Every investigation on this site followed these steps.
Each one shows what happened, how I confirmed it, and what I recommended.
A process tried to add a backdoor to a logon script registry key so it would run every time the machine started. Blocked before it could write.
A command copied the Windows SAM file, which stores local account password hashes, and User Account Control was switched off in the same session.
A search ran across Group Policy files for an old password field that some networks still use. The search came back empty on this machine.
A built in Windows tool tried to copy the memory of a process that stores login credentials. Blocked while it was in progress.
Building a deep understanding of attacker tactics, and how those attacks actually appear inside SOC analyst tools. Lessons learned from building detection from scratch.
Ran nmap against the target to learn how reconnaissance shows up in Wazuh, Splunk, and LimaCharlie. Found a gap: no single alert tied the individual service alerts together as one port scan.
The scan was barely visible in Wazuh because it was not reading the right log files. Fixed file permissions, expanded log collection, and wrote a custom rule that correctly fired on the scan.
Logs were arriving unparsed with no searchable fields. Fixed the source type mapping, then ran a full investigation from zero and found one IP that had scanned every web application on the box.
Watched the same nmap scan appear three different ways: a high level alert in Wazuh, raw log detail in Splunk, and full process level behaviour in LimaCharlie, including a root process with no alert raised.
Used a documented backdoor exploit to get a working shell. Wazuh missed the entire attack because it never touched a monitored log file. LimaCharlie caught the full process chain at the kernel level.
Built a LimaCharlie rule from scratch to catch the exact pattern Session 5 missed. Tested it against fake data first, then re ran the real exploit twice to confirm it fired against the actual attack.
All investigations were conducted in a CrowdStrike training environment as part of the CyberXcel Applied Security Program. Lab machines are personal lab assets.