SIEM search

Works like Splunk, Microsoft Sentinel or Elastic Security. Work a SOC shift: close an impossible travel alert as a false positive, find a password spray's source with a distinct count in a time bin, scope a phish to who clicked and which hosts ran it, write a spray rule that stays quiet on a normal Monday, and write the incident summary.