The DAIR model: Prepare, Detect, Verify & Triage, the Response Actions Loop, and Debrief

Incident Response Frameworks: Four Models, One Path for This Blog

A high-level look at the four incident response models worth knowing (NIST SP 800-61r3, ISO/IEC 27035, PICERL and DAIR), and why this blog will follow DAIR, one step at a time.

Oct 6, 2026 Incident Response, Fundamentals

A laptop terminal: learn, certify, meet the community, repeat

DAIR Prepare, Part 4: Training

Before detecting anything, we need to know our job. How to find your way in a vast field, then where to train in Security Operations: learning platforms, certifications, conferences and bug bounty.

Nov 10, 2026 Incident Response, DAIR

Shared incident response infrastructure: firewall VM, Traefik and the investigation platforms behind the VPN

DAIR Prepare, Part 3: Shared Infrastructure

One analyst can work from a laptop. A team needs shared infrastructure: remote collection, case management, a common timeline and threat intelligence, reachable safely and ready before the call comes in.

Nov 4, 2026 Incident Response, DAIR

Logs and visibility: endpoints first, then surrounding sources, kept in a SIEM

DAIR Prepare, Part 2: Logs and Visibility

No tool can recover what was never recorded. The logs to enable before an incident, endpoints first, and why a SIEM is what keeps them long enough to matter.

Oct 26, 2026 Incident Response, DAIR

DAIR Prepare, Part 1: The Analyst's Toolkit

The first DAIR step, from the responder's chair: the collection and analysis tools I keep ready before the call comes in.

Oct 21, 2026 Incident Response, DAIR

Inside a macOS ClickFix Stealer Using Polygon for C2 Resolution

Static analysis of a macOS ClickFix chain: obfuscated AppleScript layers, a LaunchAgent loader that reads its C2 from a Polygon smart contract, a password-phishing backdoor and the Essential macOS Stealer modules.

Oct 11, 2026 Threat Analysis, Malware