Tobi

[Tobi @otobi_tobi]

@ajanwal @osemagnum @Meiyurrrr @kentucky373 Elder @ajanwal called the council😂

[Tobi @otobi_tobi]

@sambellcumi Really got that poor guy naked

[Tobi @otobi_tobi]

UK cyber career advice needs UK context.

Salary ranges, cert expectations, job titles, and hiring patterns are not always the same as US advice online.

If you're applying in the UK, study the UK market and build proof around the roles you actually want.

[Tobi @otobi_tobi]

SOC analyst mindset:

Don't chase every rabbit hole.

Start with scope, evidence, likelihood, impact, and next action.

Curiosity matters, but structure keeps the investigation useful.

[Tobi @otobi_tobi]

A strong cyber portfolio does not need 20 projects.

It needs a few clear ones with evidence.

For blue team roles, one well-documented lab with detections, alerts, screenshots, and investigation notes can be stronger than a long list of unfinished courses.

[Tobi @otobi_tobi]

If you're learning Sentinel, reading real KQL examples can speed things up.

I created 25 detection rules you can study, adapt, and use as a base for your own lab work.

Sentinel KQL Detection Pack:
https://t.co/FYbimq1fyq

[Tobi @otobi_tobi]

Buy Practical AI Command Centre Bundle on @Gumroad https://t.co/0YrOcAhGz4

[Tobi @otobi_tobi]

Buy 30-Day Practical AI Mastery Workbook on @Gumroad https://t.co/0SNvZoTg1y

[Tobi @otobi_tobi]

Detection tuning is not about making alerts disappear.

It's about making alerts more useful.

Reduce noise, keep coverage, add context, document assumptions, and review regularly.

A quiet SIEM is not always a healthy SIEM.

[Tobi @otobi_tobi]

Free 7-Day Practical AI Starter Kit on @Gumroad https://t.co/Gfz2BaXLHy

[Tobi @otobi_tobi]

In SOC interviews, don't just list tools.

Tell stories:
- what alert did you investigate?
- what evidence did you collect?
- how did you decide severity?
- what did you document?
- what would you improve?

Stories prove capability better than buzzwords.

[Tobi @otobi_tobi]

If you want a practical blue team portfolio project, build a Proxmox + Wazuh lab and document it properly.

I made a guide to help with the structure and flow:
https://t.co/zeWbP1qJ8u

[Tobi @otobi_tobi]

A good weekend KQL project:

Pick one suspicious behaviour, then write a detection for it.

Examples:
- impossible travel
- new admin user
- suspicious PowerShell
- multiple failed logins
- risky sign-in pattern

Then document the investigation steps.

[Tobi @otobi_tobi]

Wazuh is a great way to learn blue team basics because you can see the full loop:

endpoint activity -> logs -> rules -> alerts -> investigation -> tuning

That loop is the job. The tool is just how you practise it.

[Tobi @otobi_tobi]

For anyone trying to move into SOC work from helpdesk, IT support, or a non-cyber role: build a clear roadmap.

Skills, proof, CV, interviews, labs.

That's the structure behind my UK SOC Career Guide:
https://t.co/nHJAyjCFHf

[Tobi @otobi_tobi]

Helpdesk experience is underrated for SOC work.

You learn users, endpoints, tickets, escalation, troubleshooting, and business context.

Add logs, security basics, and a small lab, and you can turn that experience into a strong SOC story.

[Tobi @otobi_tobi]

A detection rule is not finished when it fires.

It is finished when an analyst can understand:
- why it fired
- what evidence matters
- what false positives look like
- what response steps to take

Detection content should serve the person investigating it.

[Tobi @otobi_tobi]

Certs help, but they are not the whole game.

For SOC roles, you also need proof you can:
- read logs
- investigate alerts
- write clear notes
- understand basic attacks
- explain what happened

A cert gets attention. Evidence builds trust.

[Tobi @otobi_tobi]

I built 3 practical resources for people trying to break into or level up in blue team work:

- UK SOC Career Guide
- Blue Team Home Lab Guide
- Sentinel KQL Detection Pack

All here:
https://t.co/9PWwE72Kwg

[Tobi @otobi_tobi]

If you're learning Microsoft Sentinel, don't start by memorising every table.

Start with common questions:
- who logged in?
- from where?
- on what device?
- what process ran?
- what network connection followed?

Then learn the tables that answer those questions.