Skip to content
← cd ../blog

> 2025-10-03 // second-post.log · 1 min read

Blue Team Notes

#blue-team #notes

Some quick reminders.

SIEM Checks

  1. Failed logons burst
  2. New admin group members
jq '.eventId==4625' security.json