Analyst field guides · v22

Field Guides

Nine operational references aligned to the chapters and lab activities, presented in the order analysts are most likely to use them.

FG 01Analyst field guideWazuh Lab Platform Operations Quick ReferenceWazuh Lab Platform Operations Quick Reference Alerts to Answers Analyst Field Guide 01 - v20 Introduction This field guide is the operational starting point for the Alerts to…Open →FG 02Analyst field guideWazuh Dashboard Authorization-Token TroubleshootingWazuh Dashboard Authorization-Token Troubleshooting Alerts to Answers Analyst Field Guide 02 - v20 Introduction This guide addresses authorization-token failures that prevent the…Open →FG 03Analyst field guideWazuh Dashboard Session Timeout ConfigurationWazuh Dashboard Session Timeout Configuration Alerts to Answers Analyst Field Guide 03 - v20 Introduction Long lab investigations can be interrupted by short Dashboard sessions.…Open →FG 04Analyst field guideInstall, Validate, and Integrate Osquery on Ubuntu 26.04Install, Validate, and Integrate Osquery on Ubuntu 26.04 Alerts to Answers Analyst Field Guide 04 - v20 Introduction This guide builds an endpoint-telemetry path from Ubuntu…Open →FG 05Analyst field guideOsquery Windows Process-to-Network CorrelationOsquery Windows Process-to-Network Correlation Alerts to Answers Analyst Field Guide 05 - v20 Introduction This analyst guide uses a live Osquery join to connect a Windows network…Open →FG 06Analyst field guideSafe Lab Telemetry CleanupSafe Lab Telemetry Cleanup Alerts to Answers Analyst Field Guide 06 - v20 Introduction This instructor-focused field guide provides an evidence-preserving workflow for removing…Open →FG 07Analyst field guideInitial SOC Triage: First 15 MinutesInitial SOC Triage: First 15 Minutes Alerts to Answers Analyst Field Guide 07 - v21 Purpose This field guide provides a structured worksheet for the opening 15 minutes of alert…Open →FG 08Analyst field guideCyber Incident Executive SummaryCyber Incident Executive Summary Alerts to Answers Analyst Field Guide 08 - v21 Introduction Use this guide to turn verified investigation findings into a concise executive…Open →FG 09Analyst field guideForensic Container ApproachForensic Container Approach Analyst Field Guide 09 · lesson v23 · book v22 Create a defensible logical container of selected artifacts, transfer it intact, and verify what was…Open →