Alert triage
Validate the trigger, establish context, and identify what needs investigation.
Currently SOC Analyst @ Ensign InfoSecurity
// MUHAMMED IQBAL HAMDZAN · COMPTIA CySA+
IQBALHAMDZAN.
> Security Operations Analyst
Behind every alert is a story.
I follow the evidence. Approximately four years investigating security alerts, connecting context, and turning uncertainty into a defensible assessment.
Kuala Lumpur, Malaysia · SOC / BLUE TEAM
~4 yearsIN SECURITY OPERATIONS
CySA+COMPTIA CERTIFIED
04SIEM PLATFORMS IN USE
Evidence firstTHE INVESTIGATION MINDSET
Alert triageIncident investigationThreat intelligenceSecurity automation
01 / ANALYST PROFILE
Curiosity. Context. Clarity.
I’m a SOC analyst with a focus on understanding what actually happened. My work moves from alert context and raw events to historical searches, entity pivots, and evidence-labelled reporting.
I work across Microsoft Sentinel, Splunk, IBM QRadar, and LogRhythm, with EDR and threat intelligence providing the context around the signal.
Outside the queue, I build personal automation tools and develop my detection engineering skills in a lab.
More about my background“Reputation is a reason to look. Evidence is a reason to act.”
MY APPROACH TO TRIAGE
Investigation
Historical searches, related entities, and the security-control outcome.
Threat intelligence
Use enrichment to test a hypothesis and understand the wider context.
Clear handoffs
Observations, assessment, uncertainty, and an actionable next step.
02 / EXPERIENCE
The work behind the workflow.
A path through security operations, from the first alert to the next investigation.
ROLE / 03Sep 2023 — present
● CURRENT
SOC Analyst
Ensign InfoSecurity
Alert triage, incident investigation, escalation, and case documentation in security operations.
Investigation approach +
Establish alert context, inspect parsed fields and raw events, search historical activity, pivot on related entities, and validate control outcomes before documenting an assessment.
SIEM & EDRIOC analysisIncident reporting
ROLE / 02Feb — Aug 2023
Security Analyst
Building practical experience in security analysis and investigation.
ROLE / 01Aug 2022 — Jan 2023
Security internship
The starting point of my hands-on security operations journey.
03 / INVESTIGATION WORKFLOW
From signal to assessment.
Six steps. One principle: make every conclusion traceable to the evidence.
01
Frame the alert
Start with the behaviour the alert claims to detect. Identify the source, time window, affected asset, and the condition that triggered it.
A clear investigation question.
- Frame the alert. Start with the behaviour the alert claims to detect. Identify the source, time window, affected asset, and the condition that triggered it.
- Validate the telemetry. Compare parsed fields with the raw event. Check timestamps, field meaning, and gaps before treating a log entry as evidence.
- Connect the evidence. Search historical activity and pivot across IPs, accounts, hosts, and related events. Establish whether the behaviour is isolated, repeated, or part of a wider pattern.
- Enrich with context. Use threat intelligence to support a hypothesis. Consider shared infrastructure, source recency, and disagreement between providers before drawing a conclusion.
- Assess the outcome. Distinguish an attempted action from a successful one. Interpret security-control responses in context, state confidence, and make remaining uncertainty explicit.
- Document and hand off. Write down observations, assessment, uncertainty, potential impact, and the recommended next action. Give the next analyst enough context to continue.
Personal methodology, independently reconstructed. Read the full note ↗
04 / TOOLKIT
Tools with a purpose.
The platforms behind the investigation, and the skills I’m building next.
SIEM & CASE HANDLING
IBM QRadarQRadar AQLMicrosoft SentinelSplunkLogRhythmCortex XSOAR
ENDPOINT & NETWORK
CrowdStrike FalconTrellixVectraTrend Micro Apex
INTELLIGENCE & METHOD
VirusTotalAbuseIPDBCisco TalosIBM X-ForceMITRE ATT&CKIncident reporting
// PERSONAL LAB · IN DEVELOPMENTExploring detection engineering and AI-assisted workflows.
SigmaWazuh / ElasticPythonJavaScript
05 / SELECTED PROJECTS
Built from curiosity.
Personal tools for the repetitive work, and experiments that sharpen the method.
SOC AUTOMATION
IOC reputation checker
Python enrichment for IPs, domains, URLs, and hashes. Batch input, API error handling, and structured JSON/CSV output to support analyst judgement.
PythonThreat intelligence
Personal project
WORKFLOW EXPERIMENT
Incident monitoring
A browser userscript exploring notifications and audible alerts for new incident IDs. A small experiment in reducing repetitive queue checking.
JavaScriptTampermonkey
Personal experiment
AUTHORISED LAB RESEARCH
phantom-htb
An autonomous Hack The Box agent exploring enumeration, hypotheses, and structured evidence in sanctioned training environments.
Claude CodeHTB
Lab tooling
AI TOOLING
godmode
A browser console for comparing the same prompt across AI models. Bring your own API keys and inspect the outputs side by side.
Client-sideMulti-model
Personal project
Personal research. Training-platform agents are used within sanctioned or explicitly authorised scopes.
06 / CREDENTIALS
A foundation. Still building.
COMPTIA · JAN 2026
CySA+
Cybersecurity Analyst
EDUCATION
Computer Science · SecurityUniversiti Kuala Lumpur (UniKL)
Diploma · IT NetworkingPoliteknik Mersing
Next on the learning path: eJPT and a tested detection engineering portfolio.
07 / FIELD NOTES
Show the reasoning.
Personal lab work and independently reconstructed investigation methods.
NOTE / 002NOTE / 001
From alert to defensible assessment
SOC INVESTIGATION · GENERAL METHODOLOGY
Enriching an IP without trusting reputation
THREAT INTELLIGENCE · TRIAGE WORKFLOW
Employer and client data, telemetry, and internal playbooks stay private.
$ connect --analyst iqbal
Let’s make sense
of the signal.
Conversations about security operations, investigation, detection engineering, and tools worth building.
security@iqbalhamdzan.xyz