Your SIEM flags an account: about a dozen failed logins in a few minutes, then a successful one. It looks like someone guessed a password, but it looks exactly the same when a phone keeps retrying an old one. In this episode, Professor Simon walks through one hypothetical alert from start to finish, with the focus on the reasoning that transfers from one SIEM to the next, not on any product or query syntax.

He treats the alert as a question rather than a verdict and works through six steps: getting the context, building the timeline, checking the source and destination, seeing what happened after the login, arguing both the benign and suspicious stories, and writing a conclusion someone else could follow and check. Because this is audio, the examples are described, not shown, so you can follow along while you walk, drive or work.

In this episode you'll learn:

- Why an alert is a question, not a verdict

- What to check first: what the rule detects, which account is involved, and what it was signing into

- How to build a timeline and read the pattern and reasons behind failed logins

- How to check the source and destination, and how to recognize password spraying

- What to look for after a successful login: new MFA devices, inbox forwarding rules, and unfamiliar systems

- How to argue both the benign and suspicious stories, and how to write a conclusion someone else can check

▶️ Companion YouTube Video: https://youtu.be/gnl2qc-DREM

📝 Companion Blog Post: https://professorsimon.com/blog/siem-alert-investigation-failed-logins

🎧 More Podcast Episodes: https://professorsimon.com/podcast

🧭 Figure out which cybersecurity path fits you: https://careervectors.com

🔗 Resources, blog & more: https://professorsimon.com/links

🌐 Website: https://professorsimon.com

💼 LinkedIn: https://www.linkedin.com/in/leonardsimon

📸 Instagram • X • TikTok: @profsimononline

If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.