SpecterSignal

Senior SOC Analyst | Detection Engineering
Turning noise into high-fidelity signal
Alert tuning • SOC optimization • IR strategy

[SpecterSignal @SpecterSignal]

Most SOCs don’t fail because of tooling.
They fail because of signal quality.
Senior SOC Analyst focused on:
• Detection engineering
• Alert tuning
• Reducing false positives
• Better investigations
SpecterSignal
Signal > Noise.

[SpecterSignal @SpecterSignal]

Generic triggers. Broad conditions. Lots of noise.
Tuning is what sharpens them: • Adjust thresholds
• Refine logic
• Add context
• Remove known noise
Better tuning = clearer signal.
If you’re not tuning, you’re guessing.
#SIEM #DetectionEngineering #SOC #SpecterSignal

[SpecterSignal @SpecterSignal]

What’s your most noisy rule right now?
Why haven’t you tuned it?
#SIEM #SOC #DetectionEngineering #CyberSecurity #SOCs #CyberSec #infosec

[SpecterSignal @SpecterSignal]

False positives aren’t failure.
Untuned detections are.
#SIEM #SOC #CyberSecurity #SOCs #CyberSec #infosec #SecurityAnalyst #DetectionEngineering

[SpecterSignal @SpecterSignal]

Tier 1 tip:
Always check:
• User
• Host
• Parent process
• Command line
That alone solves half your alerts.
#SOCAnalyst #CyberSec #SOC #infosec #DetectionEngineering

[SpecterSignal @SpecterSignal]

@CyberRacheal C) The file's cryptographic hash

If a single letter number or anything is changed with in the file the hash value will change.

[SpecterSignal @SpecterSignal]

@cyb3rshi3ld Senior Security Analyst within the SOC.

[SpecterSignal @SpecterSignal]

SOC reality:
Most alerts aren’t attacks.
But the one real one looks exactly the same at first glance.
That’s the job.
Signal vs noise.
#SOC #BlueTeam #CyberSecurity #infosec #SpecterSignal

[SpecterSignal @SpecterSignal]

Good analysts look at alerts.
Great analysts look at behaviour chains.
Parent, Child, grandparent, Network, Lateral movement.
Think patterns, not popups.
#ThreatHunting #SpecterSignal #BlueTeam #CyberSecurity #SOC #DetectionEngineering

[SpecterSignal @SpecterSignal]

1️⃣ Monitor alerts
2️⃣ Validate signal vs noise
3️⃣ Investigate context (user, host, process)
4️⃣ Correlate activity across tools
5️⃣ Decide: false positive or incident
6️⃣ Contain + document properly
It’s not watching screens.
It’s critical thinking under pressure.
#SOC #CyberSecurity

[SpecterSignal @SpecterSignal]

EDR sees endpoint behaviour.
It does NOT see:
• Full network traffic
• Cloud logs
• Identity-wide patterns
That’s why SIEM + EDR together = power.
#CyberSecurity #infosec #SOC #DetectionEngineering #security

[SpecterSignal @SpecterSignal]

Different systems log differently.
The SIEM translates all that messy data into a common format so it can be searched and correlated.
Otherwise it’s chaos.
#cyber #CyberSecurity #SOCs #CyberSec #infosec

[SpecterSignal @SpecterSignal]

#CyberSecurity #cyberpunk #SOC #dystopia

[SpecterSignal @SpecterSignal]

Word spawns PowerShell reaches out to random IP downloads payload.
That chain matters more than the file hash.
Attack patterns.

How would you investigate this.
#cyber #CyberSecurity #SOCs #CyberSec #infosec

[SpecterSignal @SpecterSignal]

@xmodulo Ubuntu and Debain were my first choice and I still like using both to this day.

[SpecterSignal @SpecterSignal]

@CyberRacheal It is both for sure but most the time it is over complex explanations that have caused me issue and made me ask why not just make it simple and straight to the point.

[SpecterSignal @SpecterSignal]

Servers. Endpoints. Firewalls. Cloud apps. Identity systems.
If it makes noise, the SIEM can ingest it.
Think of it as a giant log warehouse.
#CyberSecurity #infosec #SOC #Security

[SpecterSignal @SpecterSignal]

Let's talk about EDR

How does it actually detect threats?
Not the marketing version. The real one.
#EDR #BlueTeam #SpecterSignal #CyberSecurity #SOC #infosec

[SpecterSignal @SpecterSignal]

@CyberRacheal A little from section A and a little from section B

[SpecterSignal @SpecterSignal]

An alert = “This matches a rule.”
Important:
An alert is NOT proof of compromise.
It’s a signal to investigate.
#SOC #CyberSecurity #SIEM #EDR
#Security

[SpecterSignal @SpecterSignal]

How does a SIEM actually work?
No vendor fluff. Just straight talk.
#SOC #SIEM #SpecterSignal #CyberSecurity