SIEM & Log Analysis + Incident Handling & Response (Combined Session)

Worum geht's?

Detection without response is just watching things burn. Tonight, we run both halves of the story back to back: first, we find it in the logs with live Splunk queries against real attack traffic from Cover6 infrastructure, then we work the full incident response lifecycle on what we just found — containment decisions, the communication chain, and the report that separates a good incident response from a career-ending one. 🎯 Part 1 — SIEM & Log Analysis * SPL (Search Processing Language) fundam