If you’re interested in tinkering with LLMs to assist with incident triage, check out this demo I did with @limacharlie.io using Claude Code and the LC MCP: youtu.be/dSCmLIBkTdo?... I open sourced the Claude configs and context files for anyone that wants to try it out: github.com/Digital-Defe...

New blog post! PowerShell transcripts for threat hunting & IR 🚀 blog.ecapuano.com/p/dfir-artif...

a certain mr @timmedin.bsky.social made a guest appearance during ASOTH day 3 today to drop some kerberoasting knowledge bombs on our students love this guy. THANK YOU TIM 🤓🫶🔥🎟️ @blackhatevents.bsky.social

ATTN NERDS: 5 more days until it's go time at Hacker Summer Camp! 💙 There's still time to register: www.blackhat.com/us-25/traini... And if you can't join us at @blackhatevents.bsky.social, check out our on demand courses 🤓🦖🔥 academy.digitaldefenseinstitute.com/catalog

T-minus 12 days until my favorite humans - @eric.zip & @whit.zip - and I deliver our Advanced Security Operations and Threat Hunting training at @blackhatevents.bsky.social. If you're a SOC analyst and/or work in IR, we'd love to have you. Come level up with us :) www.blackhat.com/us-25/traini...

Join us at the @antisyphontraining.bsky.social Blue Team Summit Aug 28 – Aug 29 for Threat Hunting & Incident Response with Velociraptor! www.antisyphontraining.com/course/threa...

1 month to go! 🤓🔥💙 Join @eric.zip, @bromiley.io, and @whit.zip at hacker summer camp! Registration: www.blackhat.com/us-25/traini...

🚀 Just launched: DetectionForge — a purpose-built platform for crafting, testing & validating @limacharlie.io detection rules. Perform detection unit tests & multi-org backtesting + import/export IaC 🔗 Try it: detectionforge.ddi.sh 💻 GitHub: github.com/Digital-Defe... #detectionengineering #secops

we had an absolutely amazing time at #x33fcon 🤓🇵🇱 thank you to our students who joined our @antisyphontraining.bsky.social class, and thank you to the organizers for taking such good care of us 🫶 poland is beautiful

Here are the slides/resources from our #SecurityFest talk on "Modernizing Incident Response Using Techniques that Scale" Talk: www.youtube.com/live/Znl7TBF...

And next week we’re in Poland for x33fcon! We’re running our 2-day workshop: Threat Hunting & Incident Response with Velociraptor www.x33fcon.com#!t/TI_IR.md

@whit.zip and I just arrived in Sweden for Security Fest and we’re so excited! 🇸🇪 cfp.securityfest.com/2025/talk/NP...

Ready to level up your SOC skills? Our Threat Hunting and IR With Velociraptor course dives deep into Velociraptor through hands-on labs and realistic attack scenarios. Learn to build custom queries, triage systems, and take decisive action—confidently and repeatably. Start here: ddi.sh/thvr 🔥🦖🤓

ATTN NERDS: we'll be teaching at @blackhatevents.bsky.social during hacker summer camp again! come join me and @eric.zip and @bromiley.io for our 4-day training: Advanced Security Operations and Threat Hunting 🤓🔥💙 www.blackhat.com/us-25/traini...

🥹💙

ATTN NERDS: join me and @eric.zip in october at @wildwesthackinfest.bsky.social where we are running our 2-day course! again! threat hunting & incident response w/velociraptor! register virtual or in-person: ddi.sh/thvr-wwhf 🤓🦖🔥 #infosec #dfir #threathunting #WWHF #Deadwood2025

Want to see a little bit of the magic behind our Threat Hunting & Incident Response w/Velociraptor course? Check out our Antisyphon webcast! www.youtube.com/watch?v=MqQ-... Now available OnDemand: ddi.sh/thvr

Our newest on-demand course, Threat Hunting and Incident Response with Velociraptor, contains over 10 hours of HD video content and 23(!) hands-on labs! You can now see a free preview of one of the 23 labs: ddi.sh/thvr-preview #DFIR #infosec #incidentresponse #threathunting

We're coming to #x33fcon! Join @eric.zip and @whit.zip in June for our 2-day Threat Hunting & Incident Response With Velociraptor course! More info: www.x33fcon.com#!t/TI_IR.md See you soon, Poland! 🥹💙🦖

WE! HAVE! STICKERS! 🥹✨

One of our students shared this in our Discord recently and our hearts are full! Whether you are an aspiring or seasoned security professional, we build hands-on training designed to help you level up! Learn more: ddi.sh/academy #infosec #training #cybersecurity #dfir #threathunting

These folks rock, you won't be disappointed!

"Threat Hunting & Incident Response with Velociraptor" On-Demand is live! Use this promo code for 20% off until 4/13: thvrlaunchpromo academy.digitaldefenseinstitute.com/courses/2259... #infosec #dfir #threathunting #incidentresponse #velociraptor

👀Check out this awesome hands-on learning that helped me out as I got started in the field!

"Threat Hunting & Incident Response with Velociraptor" coming soon in a new on-demand format! Stay tuned! 🦖 #threathunting #incidentresponse #dfir #infosec

@eric.zip and @whit.zip will be back in Deadwood! Join them for pre-con training class, Threat Hunting and Incident Response with Velociraptor, at WWHF - Deadwood 2025! --> wildwesthackinfest.com/wild-west-ha...

Want to wield Velociraptor like a pro? Join @eric.zip & @whit.zip in October at @wildwesthackinfest.bsky.social where we are running our 2-day course, Threat Hunting & Incident Response w/Velociraptor! Register virtual or in-person: ddi.sh/thvr-wwhf #infosec #dfir #threathunting #WWHF #Deadwood2025

Have you ever needed a ready-to-go #DFIR triage collector in a pinch? I got you covered! All you need to remember is triage.zip 🚀 It's a prebuilt Velociraptor collector configured to grab all the things you probably need for initial forensic analysis.

Join us at @blackhatevents.bsky.social for "Advanced Security Operations & Threat Hunting" This course is perfect for those specializing in detection engineering, threat hunting, adversary detection, and incident response. #infosec #dfir #BHUSA Register: ddi.sh/bh-usa-2025

We're running "Threat Hunting & Incident Response w/Velociraptor" at #x33fcon June 10 - 11 in Gdynia, Poland! Register here: www.x33fcon.com#!t/TI_IR.md #dfir #infosec

New blog post: Introduction to YARA blog.ecapuano.com/p/introducti... #infosec #dfir

We've launched our first of many on-demand #infosec courses on the new DDI Academy! academy.digitaldefenseinstitute.com The first course is a total revamp of @eric.zip's popular "So You Want to be a SOC Analyst?" series. Rebuilt from the ground up, and now all you need is a web browser!

ATTN NERDS: We'll be at @blackhatevents.bsky.social USA again this year! Registration is now open for our Advanced Security Operations and Threat Hunting course 🤓🔥💙 Join @eric.zip, @bromiley.io, and @whit.zip for our 4-day training: www.blackhat.com/us-25/traini...

Wrapping up day 2 of THVR @wildwesthackinfest.bsky.social Mile High 🤓💙🦖 Threat hunting ✅ Sick beats ✅ Lots of nerd jokes ✅ Shameless playlist plug: open.spotify.com/playlist/11v... Delivered with 🫶 by @eric.zip and @whit.zip

Hellooo, Denver! 🤓💙 Day 1 of Threat Hunting/Incident Response With Velociraptor @wildwesthackinfest.bsky.social Mile High is well underway!

See you nerds in Denver soon! 🤓💙🏔️

also, NIMS is 100% @eric.zip's brainchild. he started it a few weeks ago and i've been testing and providing feedback along the way last week i dove in with him and wrote the middleware for it, github.com/shortstack/n..., and we geeked out all weekend, bingeing shows and making new nerd toys 🥹🌈

🚀 Excited to announce the alpha release of NIMS - a Notion-based Incident Management System! Designed for SOC/IR teams, NIMS helps streamline incident management and collaboration using Notion's powerful database features. #InfoSec #DFIR #IncidentResponse #SecOps #Notion

Ready to take your threat hunting & IR game to the next level? Join us this February at WWHF Mile High for Threat Hunting & Incident Response with Velociraptor! 🖥️ Hands-on labs with cloud VMs 👨‍🏫 Expert-led by @eric.zip & @whit.zip 🎯 Real-world hunting skills

Want to learn more about Velociraptor? 🦖🤓💙 Join @eric.zip and @whit.zip at @wildwesthackinfest.bsky.social Mile High in February! ⛰️ Available in person or virtual! 🙌 Course details: www.antisyphontraining.com/course/threa... Register: wildwesthackinfest.com/wild-west-ha...

Want to learn more about Velociraptor? Come attend our hands-on Threat Hunting & Incident Response w/Velociraptor course at WWHF Mile High in February! Virtual option still open but only for a limited time! www.antisyphontraining.com/course/threa...

Do you use Velociraptor? 😎🦖 Join us at @wildwesthackinfest.bsky.social in February and level up! Learn to use Velociraptor’s advanced features for threat hunting and incident response at scale 🔥 Details: www.antisyphontraining.com/course/threa... Register: wildwesthackinfest.com/wild-west-ha...

#Linux lacks a resource like the Windows Master File Table ($MFT). I've developed this #Velociraptor artifact to collect metadata from files and folders recursively in selected paths to create a bodyfile. This may bring an MFT-like feel to filesystem analysis. #dfir github.com/chrisdfir/Ve...