RMYEGRaghav MahajanYEG-2026-001Public

Newsletter · Filed dispatches

Blue Team Brief

The week's real attacks in plain English. What happened, why it matters, what to hunt for. One edition most weeks, written from Edmonton, read by defenders across Canada and beyond.
Blue Team Brief Edition 13 cover
Exhibit N · Cover art, edition 13

LATEST DISPATCH

Latest

When the Cloud Goes Down, Everyone Goes Down

EDITION 13 · FILED OCT 18, 2026

The newest edition of the Brief. Real incidents, plain language, and the one thing worth hunting for in your own environment after each story.

The archive

11 earlier dispatches

GET THE NEXT DISPATCH

Filed straight to your inbox

One email per edition, nothing else. Unsubscribe any time.

Blue Team Brief

The week's real attacks in plain English: what happened, what to hunt for. Plus notes from the homelab. No spam, ever.

[INFO] Wazuh agent heartbeat · DC-01 · homecorp.local · OK·[WARN] Failed SSH auth attempt · 192.168.56.102 · Rule 5710 · Level 5·[INFO] Nmap scan completed · WEB01 · 23 open ports detected · Logged·[ALERT] Hydra brute-force detected · admin@192.168.56.101 · BLOCKED·[INFO] SPL query executed · index=security · 4,892 events returned·[INFO] ISC2 CC · PASSED · 2024 · Credential active·[INFO] CompTIA Security+ SY0-701 · PASSED · 2025 · Credential active·[WARN] Gobuster scan detected · /api/admin · 403 returned · Alert fired·[INFO] Wireshark PCAP capture · eth0 · 12,441 packets · Saved·[INFO] System status · LEARNING · BUILDING · AVAILABLE FOR SOC ROLES·[INFO] GPO applied · homecorp.local · Password policy · min 12 chars·[ALERT] Nikto scan from KALI01 · WEB01 · Wazuh alert · Severity: High·[INFO] Wazuh agent heartbeat · DC-01 · homecorp.local · OK·[WARN] Failed SSH auth attempt · 192.168.56.102 · Rule 5710 · Level 5·[INFO] Nmap scan completed · WEB01 · 23 open ports detected · Logged·[ALERT] Hydra brute-force detected · admin@192.168.56.101 · BLOCKED·[INFO] SPL query executed · index=security · 4,892 events returned·[INFO] ISC2 CC · PASSED · 2024 · Credential active·[INFO] CompTIA Security+ SY0-701 · PASSED · 2025 · Credential active·[WARN] Gobuster scan detected · /api/admin · 403 returned · Alert fired·[INFO] Wireshark PCAP capture · eth0 · 12,441 packets · Saved·[INFO] System status · LEARNING · BUILDING · AVAILABLE FOR SOC ROLES·[INFO] GPO applied · homecorp.local · Password policy · min 12 chars·[ALERT] Nikto scan from KALI01 · WEB01 · Wazuh alert · Severity: High·