07 - References and Further Reading

Frameworks & Methodologies

• MITRE ATT&CK Framework: The global standard for understanding adversary tactics and techniques.
  • https://attack.mitre.org/
• SANS Incident Handler's Handbook: Core methodologies for Incident Response (PICERL).
  • https://www.sans.org/white-papers/33901/
• Sigma Rules: Generic signature format for SIEM systems.
  • https://github.com/SigmaHQ/sigma

Open-Source Tools Documentation

• Wazuh (SIEM/XDR):
  • https://documentation.wazuh.com/
• Shuffle (SOAR):
  • https://shuffler.io/docs/
• MISP (Threat Intelligence):
  • https://www.misp-project.org/documentation/
• CyberChef (Swiss Army Knife for Triage):
  • https://gchq.github.io/CyberChef/

Recommended Reading & Reports

• SANS Annual SOC Survey: Insights into the challenges, metrics, and architectures of modern SOCs.
• Red Canary Threat Detection Report: Annual report detailing the top ATT&CK techniques observed in the wild.