Analyst Workflow: Hunting Down A Phishing Attack

In this video, we are going to walk through basic operations within Gravwell query studio that an analyst might rely on when exploring their data. We will gradually step up in complexity throughout this video and ultimately illustrate a common workflow that many SOC analysts are familiar with: hunting for a phish. The purpose of this content is to step through basic, common queries that a Security Operations Center analyst might use when trying to orient themselves to their data sources. We will use a series of exploratory queries on tabular data that has been setup with an auto extractor in advance. It is intentionally basic but builds up some basic, important tooling that any analyst will love to have available.