Cyber on a Budget Edition
Most blue‑team tool guides read like shopping lists for SOCs with unlimited budget and unlimited time. But real triage doesn’t happen in a lab full of exotic tools, it happens in the middle of a workday, with an alert on your screen, a user waiting for an answer, and a small set of reliable tools you know inside out.
This guide reflects the workflow I actually use every day. Not the “ultimate toolkit”. Just the practical, simple, budget‑friendly tools that get me from signal to understanding to resolution quickly and consistently.
I’m including the real stories, the moments where these tools taught me something, saved hours, or revealed the truth behind an incident.
Morning Triage Ritual
Back when I used to get in early, the office was quiet, the good kind of quiet. The lights were still warming up, the air‑con was humming, and it felt like the whole building was giving me a head start. It was the perfect time to sit down with a fresh cappuccino and review the Sentinel alerts that came in overnight.
But every analyst knows that moment, the one alert that makes you stop mid‑sip and think, “Not today… I just made this coffee.”
You start digging into the alert, following the threads, checking the logs, pivoting through the timeline… and before you know it, an hour has passed. You look over and realise your delicious cappuccino has gone stone cold. Completely forgotten.
So you get up to make another one, only to find a line at the coffee machine because now everyone else has arrived.
That’s triage life. Quiet mornings, dramatic alerts, and more cold coffees than I’d like to admit.
1. SIEM (Sentinel) – The Starting Point for Every Investigation
Whether it’s Microsoft Sentinel or whatever SIEM your organisation relies on, this is always where the investigation begins. It’s the central nervous system of the environment, the point where identity, network, cloud, and endpoint signals all collide.
The SIEM provides:
- correlated alerts
- identity activity
- network flow
- cloud events
- UEBA insights
- cross‑system context
- timelines and relationships
It gives you the shape of the incident before diving into specifics.
SIEM Story – The Day I Learned Context Matters
When I deployed my first SIEM, I was green enough to take every alert literally. One morning, a dramatic alert came through showing a script executing on our system administrator’s machine. It looked bad, the kind of bad that makes your stomach drop. For a moment, I genuinely thought, “He’s been compromised.”
But as we walked through his day step‑by‑step, the truth surfaced, the “malicious script” was something he had run himself earlier that morning as part of routine maintenance.
Nothing was wrong. No breach. No attacker. Just a SIEM doing its job and me learning one of the most important lessons in triage.
Alerts don’t give you context. You have to go find it.
2. Microsoft Defender – XDR and the Endpoint Truth
No matter if your stack uses Microsoft Defender or another XDR, email security, or antivirus platform, this is where the investigation zooms in.
Defender gives you:
- process trees
- command lines
- device timelines
- file behaviour
- network connections
- correlated endpoint alerts
It’s the microscope after the SIEM gives you the map.
Defender Story – When the Timeline Finally Made Sense
When I first started using Defender, I found it overwhelming. There are so many panes, tabs, and timelines that it can feel like you’re navigating a cockpit rather than a security tool. And yes, Defender can be clunky until you know where to look.
One investigation changed that for me. I needed to figure out where a suspicious file had executed from. The alert alone wasn’t enough, so I opened the Device Timeline. Suddenly everything clicked. The timeline was incredibly detailed, every process, every command line, every file touch, all laid out in order.
I searched for a keyword related to the file, and the whole picture appeared:
- where the file came from
- when it executed
- what triggered it
- every version sitting on the machine
With that context, I was able to fully remediate the system.
That was the moment I stopped seeing Defender as “busy” and started seeing it as precise.
Defender Story – When Deep Analysis Meets… Business as Usual
I remember one morning getting completely lost in a Defender timeline, stepping through every process, every command line, every file touch, reconstructing the sequence like I was unravelling a major breach. You know that feeling when you’re in the zone, building the narrative, thinking, “Alright, this is getting interesting…”
And then you finally reach the root of it and realise… It’s just a business‑as‑usual application doing business‑as‑usual things.
No compromise. Just Defender being enthusiastic.
You turn to your colleague and say, completely deadpan, “Are you as excited as I am?”
It’s humbling, and honestly, it’s part of the job. Sometimes Defender gives you a real threat. Sometimes it gives you a false alarm with great storytelling.
3. Azure Logs – The Reality Check
Azure Logs, or your identity logs, whatever platform you use are the authoritative source for identity and cloud activity. They confirm what actually happened behind the scenes.
Key logs include:
- Sign‑ins
- Audit logs
- Conditional Access
- Identity Protection
- Firewall logs
- Network flow logs
If the SIEM is the story, Azure logs are the raw evidence.
Azure Logs Story – Context Is Everything (Even When It Means Talking to Users… yuck)
Azure logs are gold, but they can also be misleading if you don’t understand the human context behind them.
When I’m investigating identity‑based activity, I always check:
- the device they’re signing in from
- the location
- whether MFA was correct
- whether the password or token was valid
- whether Conditional Access succeeded or failed
One case stands out: a user suddenly appeared to be signing in from London. At first glance, it looked suspicious. But after checking their calendar and speaking with their team, it turned out they were literally on holiday in London.
Other times, the “impossible travel” is just someone on a VPN. That’s when you line up:
- VPN IP ranges
- Locations
- known endpoints
- authentication success/failure
- the app they were accessing
- Conditional Access outcomes
Azure logs give you the truth but you still need to interpret it.
And yes, sometimes you have to talk to users… I know, tragic. But context isn’t in the logs, it’s with the humans behind them.
4. Sandbox – Behaviour Over Assumptions
When you need to know what a file or URL actually does, a sandbox provides observable behaviour:
- dropped files
- registry changes
- network calls
- screenshots
- behavioural indicators
It removes guesswork and replaces it with clarity.
Sandbox Story – The Safe Place to Break Things
I use a sandbox constantly. If something looks suspicious, a file, a URL, a strange attachment, I just throw it in and let the sandbox do its thing. If your company has one, use it. If not, you can set up your own. The point is simple: you get to see what the file or URL actually does without risking anything.
I’ve had plenty of emails get stopped because of redirects. On the surface, that looks bad. But sometimes the sender just used a bit.ly link or some marketing redirect chain, and it’s completely harmless. The only way to know for sure is to test it safely.
The sandbox shows you:
- if the URL redirects
- where it redirects to
- whether it downloads anything
- what the file tries to execute
- what processes spawn
- what network calls happen
And the best part? You can mess up. You can click the wrong thing, run the wrong file, follow the redirect and it doesn’t matter.
The environment wipes clean when you’re done.
Sandbox Reality Check
One thing you learn quickly about sandboxes is that they’re not invisible. Attackers know they exist, and plenty of back‑end systems are designed to detect them. Sometimes instead of showing you the real payload, they’ll redirect you to something completely random, like a page full of famous pottery from around the world.
That’s when you realise the sandbox has been spotted and you’re not getting the full behaviour.
And that’s the limit of sandboxes:
they’re powerful, but they’re not perfect.
Sometimes you won’t capture every IOC, malware refuses to run and sometimes you get pottery instead of payloads.
And that’s when experience kicks in. You look at the URL, the behaviour, the context, the reputation, the user report and you just know it’s dodgy. No need to overthink it. No need to chase the perfect forensic breakdown.
You block it, you remediate, and you move on to the next job.
Because in triage, perfection isn’t the goal, momentum is.
5. Kali Linux (Burp Suite + Nmap) – Validation, Not Offense
Kali isn’t just for penetration testers. In blue‑team triage, it’s a validation toolkit.
Useful for:
- checking open ports
- inspecting URL behaviour
- testing server responses
- verifying suspicious IPs
- observing redirects or anomalies
Kali Story – Burp, Nmap, and the Shadow IT Surprise
Kali is awesome. It has so many tools, but the two I keep coming back to are Burp Suite and Nmap.
Burp is perfect for reviewing how a website behaves. I love using the proxy feature to watch requests flow through, you see every redirect, every header, every odd behaviour that a normal browser hides from you.
And then there’s Nmap.
Sometimes you get wind of a suspicious server in an alert, and before you go knocking on a system admin’s door, you want to know what you’re dealing with. So you run a quick scan:
- What ports are open
- What services are running
- What OS it might be
One time I was notified about a potential shadow IT service a team was running. A few Nmap scans later, I found out they had built their own system, wrapped up in a neat little package.
Nmap Story – The Server Everyone Forgot About
My vulnerability scanner once picked up an interesting device sitting quietly on the network. Nothing labelled, nothing obvious, just… there. And my first thought was, “If this thing’s internet‑facing, we are screwed.”
So I pulled out Nmap to suss out what it actually was.
A few scans later, the picture formed: it was a specific application server but something felt off. The versions were old, the ports didn’t match production, and the whole thing had that “I shouldn’t exist anymore” energy. I felt like Indiana Jones adventuring through a cursed tomb, brushing dust off ancient services and hoping nothing jumped out at me.
So I logged a ticket and asked the team to update it. Their response?
“Oh that thing? We don’t use it. You can get rid of it.”
It turned out to be a forgotten test server, the server equivalent of that 100th Chrome tab you forgot you had open from last month until your RAM ran out.
Moments like that remind you why validation tools matter. Sometimes you uncover threats. Sometimes you uncover archaeology.
6. AI‑Assisted Triage – Your On‑Demand Analyst
AI has become a powerful triage accelerator. Not a replacement for analysis but a force multiplier. Copilot, ChatGPT, Claude, Gemini. Each one’s good at something different, so why limit yourself when you can use the whole toolbox.
AI Story – The New Triage Superpower
AI is a fairly fresh addition to my workflow, but it’s already unlocked a whole new level of efficiency.
Now, instead of spending ten minutes trying to decode a weird URL, I can just ask:
- “What does this URL actually mean”
- “Is this domain legitimate”
- “What does this company even do”
And the best part? There are no stupid questions. Sometimes the URL turns out to be a normal service endpoint.
Sometimes the “mystery company” turns out to be in the exact same industry as the user’s job. AI helps me make sense of hashes, files, and weird indicators instantly, context I would’ve spent ages gathering manually.
When I first tried using AI for triage, it wasn’t great. But it’s getting better and I’m getting better at using it.
AI doesn’t replace analysis. It accelerates it.
7. Free TAXII CTI Feeds – Enrich Your SIEM With Real Threat Intel
TAXII feeds strengthen your SIEM with fresh, structured intelligence:
- indicators of compromise
- threat actor profiles
- malware families
- campaign data
- TTPs
They don’t replace your triage workflow they enhance it.
MITRE ATT&CK and AlienVault OTX both have solid reputations, and they’re great starting points if you want to level up with free TAXII CTI feeds to enrich your indicators. I’ll cover that properly in a separate article.
8. Reputation & Intelligence Checks – VirusTotal, AbuseIPDB, and SIEM Correlation
Reputation tools are the quickest way to validate whether an IP, URL, or file is behaving normally or showing signs of malicious activity. I use them constantly to confirm patterns I see in the SIEM.
Reputation Story – When “Overseas Travel” Turned Into a Global Login Tour
We had a user legitimately working overseas, and at first everything looked normal. Their sign‑ins were coming from Canada, which matched their travel. But then the same account started logging in from Malta, China, Germany, the USA, and back to Canada again. All within short windows.
That’s when I pulled the IPs into AbuseIPDB and VirusTotal. The pattern was immediate:
TOR exit nodes and high‑risk IP ranges. Our SIEM, which ingests threat intel via TAXII, flagged several of the same IPs.
The conclusion was clear: the user had been compromised while overseas, and the attacker was trying their luck from everywhere.
But here’s the part that saved us:
- MFA blocked every attempt
- Conditional Access denied risky locations
- Impossible travel rules triggered
- The SIEM stitched the whole pattern together
The attacker had the password but they never got in.
Reputation checks didn’t solve the incident. They confirmed the story the logs were already telling.
9. Rare but Powerful Tools – For Deep or Unusual Cases
These tools shine when incidents go beyond standard triage:
- Sysinternals
- Chainsaw
- Velociraptor
- Shodan
- Maltego
- Volatility
You won’t use them every day but when you need them, nothing else will do.
10. Lessons Learned – Communication & Context Is King
After years of doing this work, the biggest lesson I’ve learned is simple: Context is king. Tools give you signals. Logs give you clues. Alerts give you symptoms. But context is what turns all of that into understanding.
Triage isn’t about reacting to a single indicator, it’s about combining everything you see across your tools and building a case for what’s actually happening. Sometimes that means digging through logs, sometimes it means validating behaviour in a sandbox, and sometimes it means doing the thing every IT stereotype says we’re terrible at… talking to people.
Even today, I still feel like I’m bothering someone when I reach out. But I do it anyway. Because the one time you don’t ask the “silly” question is the time it turns out it wasn’t silly at all. Confidence and communication skills matter just as much as technical skills.
Never accuse anyone, be kind, ask politely and make friends with your IT Team, sysadmins and network admins. They’re your allies, not obstacles.
And finally: finding tools is fun. Playing with them, learning them, breaking things in safe environments that’s how you grow. But not every tool belongs in your daily triage workflow. You don’t need every tool, you don’t need to overwhelm yourself. A clean workflow, a handful of reliable tools, and the experience to know when to bring in something extra, that’s what makes you effective.
Context. Confidence. Communication.
That’s the real blue‑team toolkit.
Continue Reading
Check out my other articles! If you enjoyed this one, you’ll probably like the rest of my cyber stories, guides, and breakdowns too.