THE PORT0 BLOG
Expert perspectives, real-world stories, and actionable advice for teams that run operations instead of triaging alerts.
Featured PostTwo critical PHP RCE bugs leaked ahead of disclosure. Before the 14:00 UTC fix shipped, Soc0 had turned a news story into three behavioral detectors running on our clients' data. Here is how, and what attackers did next.
An agentic SOC runs investigations end to end without a pre-written playbook. Here is the working definition, how it differs from SOAR and copilots, and the failure modes that show up in production.
A coverage map of endpoint and network telemetry, built from what each sensor collects and where each one goes dark.
Five metrics, a sampling rule, and a three-stage rollout for testing whether AI verdicts hold up on your own alerts.
Six ways NDR acquires traffic, what each method misses, and what AWS, Azure and Google document about their own mirroring limits.
A six-stage order for SOC automation, from evidence gathering to contained response, with the research behind each stage.
TLS 1.3 hid the certificate, ECH hides the server name, and Chrome broke JA3. A field-by-field map of which network detections still work.
Field notes from Black Hat USA 2026, read from the network side: the agents are moving faster than the data feeding them.
Move beyond noisy alerts to build detections that find what attackers actually do.
Standalone NDR sees packets. Fused network security sees stories. A capability-by-capability comparison, pros and cons included.
Smarter detections, better workflows, and more ways to accelerate your SOC.
A look at the most active threat groups, their targets, and attack patterns.
Practical ways to reduce fatigue and build healthier on-call rotations.
Tips for writing portable, effective detections with Sigma.
Subscribe to get the latest posts delivered to your inbox.
