https://eshsoc.nl/blog/Recent content in R&D blog on Eindhoven Security HubHugoen-GBThu, 29 Oct 2026 00:00:00 +0000https://eshsoc.nl/blog/2026/soc-experience-at-the-analysts-fingertips/Thu, 29 Oct 2026 00:00:00 +0000https://eshsoc.nl/blog/2026/soc-experience-at-the-analysts-fingertips/<figure> <img src="https://eshsoc.nl/images/blog/soc-assistant/hero.webp" alt="On the left, the case data an analyst is looking at: an alert that a laptop looked up a web address used by a known criminal group, a DNS log line and a web-traffic line with an unusual browser name. On the right, notes the assistant attaches to those lines: from ESH’s past cases, we have seen this malware before and it arrived with cracked software; what our analysts checked then, the user’s web history before the alert and the fake browser name; from threat reports, it steals saved passwords and crypto wallets; and a suggested next check, whether the laptop connected to that server."> <figcaption><p><strong>The idea.</strong> The analyst’s case data on the left; on the right, knowledge the assistant attaches to it from ESH’s past investigations and from threat reports, plus a concrete next check. Based on the test case used in the study.</p></figcaption> </figure>https://eshsoc.nl/blog/2026/profiling-cloud-sign-in-behaviour/Thu, 08 Oct 2026 00:00:00 +0000https://eshsoc.nl/blog/2026/profiling-cloud-sign-in-behaviour/<figure> <img src="https://eshsoc.nl/images/blog/entra-id-profiling/hero.webp" alt="On the left, five example lines from a sign-in log: a user opening Outlook Mobile and OneDrive from the office network, a guest using Microsoft Teams from home, a sync bot connecting to the directory from a data centre at night, and a service account signing in interactively to the Power Platform admin centre. A note says the study used 1.26 million such lines from 402 accounts over five months. In the middle, a bar labelled profiling. On the right, the behaviour profiles that come out: internal staff work across many apps; automated accounts do one task from one network; external guests mostly use Microsoft Teams; and, flagged by the experts, a service account meant for a mailbox that developers also used for admin work."> <figcaption><p><strong>The idea.</strong> Single sign-in events on the left, the behaviour profiles learned from them on the right. The log lines are illustrative; the profiles are among those found in the study.</p></figcaption> </figure>https://eshsoc.nl/blog/2024/a-structure-for-every-alert-investigation/Wed, 07 Feb 2024 00:00:00 +0000https://eshsoc.nl/blog/2024/a-structure-for-every-alert-investigation/<figure> <img src="https://eshsoc.nl/images/blog/give-me-structure/hero.webp" alt="On the left, an alert from the study: a signature named ET JA3 Hash, Abuse.ch, Possible Dridex, with only 9 packets of traffic. A note says that analysts without the structure dismissed it: alerts of this kind are usually false positives, and the traffic was small. On the right, the four stages of the structure, each with what it asks and what it turned up for this alert. Relevance indicators: is the alert specific, recent and within what the SOC monitors for this customer. Additional alerts: the same IP address also appeared in a botnet command-and-control alert. Contextual information: a connection from a suspicious address to the host was established. Attack evidence: the activity is malware-related, so the impact on the customer would be high. At the bottom, the outcome: escalated to tier 2."> <figcaption><p><strong>The idea.</strong> An alert from the study, investigated along the four stages. Analysts who followed them found the related alert in the second stage and escalated it; analysts without them dismissed it.</p></figcaption> </figure>https://eshsoc.nl/blog/2022/a-new-concept-for-securing-the-region/Mon, 05 Dec 2022 00:00:00 +0000https://eshsoc.nl/blog/2022/a-new-concept-for-securing-the-region/<p>In recent years we have witnessed a change in focus of cyber-attackers, who are now increasingly often targeting even small and medium-sized enterprises (SMEs), including organisations such as hospitals, local and regional government, and NGOs. Because of this, more and more organisations are building or using a security operations center (SOC) to protect themselves against the latest cybersecurity threats.</p>