Resources
Tools, references and reading I keep coming back to.
Threat intel & news
- CISA Known Exploited Vulnerabilities The KEV catalog; good for patch prioritization.
- The DFIR Report Detailed intrusion write-ups with timelines.
ICS / OT
Network detection
- Zeek documentation
- RITA Beacon, long-connection and DNS tunneling analysis over Zeek logs.
Training & labs
- Malware Traffic Analysis Real pcaps with exercises.