Cover6 Community

Cover6 Community — June Meet & Greet

The technical series is heating up — and so is the summer calendar. Join us for our June Meet & Greet before the community heads into a packed July (and DEF CON season in August).

🎯 What to Expect
- Network with Cover6 Community members
- Preview of the July sessions
- CyberjutsuCon preview — Tyrone will be training there; get the inside track
- Open Q&A — bring your lab questions, your career questions, your cert questions

No slides. No lecture. Just the community getting together.

June was the red team. July is the blue team. We built the AD lab in June — now we're going to attack it on Cover6 infrastructure and watch the alerts fire in real time. Same environment. Same attack chain. Different seat.

🎯 What We'll Cover
- Windows AD forensics — what an attacker leaves behind in the logs
- Event ID deep dive — the 10 IDs every SOC analyst needs to memorize
- BloodHound attack paths — reading the output as a defender
- Kerberoasting detection in Splunk
- Golden Ticket indicators — what makes it "impossible" and how to spot it

Want to follow along in the cloud? Spin up your own Kali droplet: https://m.do.co/c/84eb8a434ffd

Splunk is the language of the SOC, and Security Onion offers a taste of useful dashboards. Tonight, we run live queries against real attack traffic from Cover6 infrastructure.

🎯 What We'll Cover
- SPL (Search Processing Language) fundamentals — the queries you actually need
- Building correlation searches
- Dashboards for SOC analysts — what to monitor at a glance
- Triage workflow — from alert to investigation to escalation

Detection without response is just watching things burn. This is about what happens after the alert fires — the IR workflow, containment decisions, and the communication chain that separates a good incident response from a career-ending one.

🎯 What We'll Cover
- NIST IR lifecycle — Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned
- Containment decisions — isolate the host vs. preserve the evidence
- Timeline reconstruction — building the attack story from logs
- Incident communication — what to tell leadership and when
- Lessons learned and post-incident report structure