OODA Loop: The Security Operations Framework
Observe, Orient, Decide, Act: how a fighter-pilot decision framework maps onto SOC monitoring, triage and incident response, and why tempo wins.
Read the article →Field Notes
From the InfoSec Professional Desk
Practical writing on security operations, what to log, what to detect, and how defenders actually win.
Featured article
All articles
Latest writing
Defenders Have to Be Right Every Time. Attackers Only Need to Be Right Once
The most repeated line in security is only half true. Where the asymmetry cliché breaks down, and how defense-in-depth flips it back on the attacker.
Threat Detection Bypass in Active Directory: Techniques and Mitigations
How attackers evade common Active Directory detections, and the audit policy, telemetry and mitigation changes that take those blind spots away.
PowerShell Logging for Blue Teamers
Module logging, script block logging and transcription, the three PowerShell logging layers every blue team should enable, and what each one actually catches.
Sysmon for Linux: Endpoint Telemetry Beyond Windows
Sysmon is no longer Windows-only. What Sysmon for Linux captures, how to deploy it, and where it fits next to auditd in a monitoring stack.
Maximizing SIEM Efficiency: Prioritizing Log Sources for SOC Implementation
Not all logs are equal. How to prioritize log sources during a SIEM implementation so the SOC gets detection value first, not just volume.
Unraveling RDP Events: Remote Desktop Visibility for Defenders
RDP remains a favorite path for attackers. The Windows event IDs that reconstruct an RDP session from connection to disconnect, and the detections to build on them.
Threat Intelligence 101: An Introduction to Cybersecurity's Frontline Defense
What threat intelligence actually is, the difference between strategic, operational and tactical intelligence, and how a SOC turns feeds into decisions.
Enhancing Threat Detection with Microsoft Sysmon
Why Sysmon remains the highest-value free telemetry on Windows, the events that matter, configuration philosophy, and detections to build first.
No articles match.
Medium archive
On Medium
Everything I've published on Medium, each preview links to the full article at shreenkhalabhattarai.medium.com.
International Women's Day 2025: Accelerate Action for Gender Equality
Reflections on accelerating action for gender equality in cybersecurity and beyond.
Read on Medium ↗
OODA Loop: The Security Operation Framework
Applying the Observe–Orient–Decide–Act loop to security operations, a framework for faster, better decisions in the SOC.
Read on Medium ↗
Defenders Have to Be Right Every Time. Attackers Only Need to Be Right Once
Unpacking the asymmetry cliché, what it gets right, what it gets wrong, and what it means for how defenders should think.
Read on Medium ↗
Threat Detection Bypass in Active Directory: Techniques and Mitigation Strategies
How attackers evade common Active Directory detections, and the logging and mitigation strategies that close the gaps.
Read on Medium ↗
PowerShell Logging for Blue Teamers
Building a robust PowerShell logging pipeline, module logging, script block logging and transcription for effective monitoring and detection.
Read on Medium ↗
Sysmon For Linux
Deep insights into processes and activities on Linux hosts with Microsoft's Sysmon for Linux.
Read on Medium ↗
Maximizing SIEM Efficiency: A Guide to Prioritizing Log Sources for Effective SOC Implementation
SIEM is essential to a strong security strategy, but only if the right log sources are prioritized. A practical prioritization guide.
Read on Medium ↗
Unraveling RDP Events: Understanding Remote Desktop Protocol for Enhanced Security
Within the SOC, visibility is everything. Reading RDP events to reconstruct sessions and catch lateral movement.
Read on Medium ↗
Threat Intelligence 101: An Introduction to Cybersecurity's Frontline Defense
Turning the telescope outward, what threat intelligence is and how it informs defensive decisions.
Read on Medium ↗
Enhancing Threat Detection with Microsoft Sysmon
Using Sysmon's rich Windows telemetry to detect increasingly sophisticated threats.
Read on Medium ↗
Certification & Resources to Develop Skills as a SOC Analyst
Certifications and learning resources for building a career in security operations. Published in the CryptoGen Nepal publication.
Read on Medium ↗