https://paidsec.com/Recent content on paidsecHugoen-usWed, 22 Jul 2026 15:00:19 -0400https://paidsec.com/posts/sentinel/Wed, 22 Jul 2026 15:00:19 -0400https://paidsec.com/posts/sentinel/<h1 id="whoami">whoami</h1> <hr> <p>If you haven&rsquo;t read my <a href="https://paidsec.com/about">about page</a>, I am a full time blue team employee who enjoys doing red team on the side. Blue team pays the bills and red team keeps my brain happy. I&rsquo;ve been working in a SOC like environment for a few years now and would like to share in this post how <a href="https://breachlab.org">Breachlab.org</a> Sentinel compares to a real world SOC environment. One thing I do need to preface before the rest of this post is that at my current employment we do not have a &ldquo;by the book&rdquo; SOC team. We are missing a few members which means that we all need to fill multiple roles all at the same time. &ldquo;Wearing many different hats&rdquo; as my boss would say. One day I could be just doing triage, and the next I could be working on system architecture and detection rules.</p>https://paidsec.com/about/Tue, 16 Jun 2026 11:25:26 -0400https://paidsec.com/about/<p>I defend networks for a living and attack them for fun — and I&rsquo;ve started to suspect the second part is where I&rsquo;m headed.</p> <h2 id="the-day-job-blue-team">The day job: blue team</h2> <p>My professional home is on the defensive side. There&rsquo;s a particular satisfaction in blue team work that doesn&rsquo;t always get talked about: the quiet win of an alert that fires exactly when it should, the slow craft of tuning detections until the noise falls away and the real signal stands out. I like building the systems that catch things, reading the logs nobody else wants to read, and knowing that on a good day the most interesting thing that happens is nothing at all.</p>