Security Analysis 101: IPs, Domains, OSINT, IOCs, Oh my! — why we can’t always trust what we see and hear

Wrote a new article quickly tonight to help the SOC I manage. Had some people mass closing out alerts based on clean IPs among some other things so I started a new series talking about some common things and ways to confirm activity in logs.
Let me know what you all think! Hopefully it also helps you if you are new to this.
https://medium.com/@truvis.thornton/security-analysis-101-ips-domains-osint-iocs-oh-my-2ae670250fe1

alerts analysis article blueteamsec domains iocs ips manage osint people quickly security security analysis series soc talking things trust