Choosing the incident window before you draw a single line
How security teams in the United Kingdom should pick the start and end of an incident trend picture so the charts stay honest.
Read the noteJournal
Notes from the drawing table
Short pieces on windows, colour, extracts, and the walkthrough — written for people who already sit with detections.
Severity colours that survive a meeting
Practical rules for colouring cybersecurity event charts so severity bands stay readable in print and on a projector.
Read the note
What to send us instead of administrator access
A source list for incident trend pictures that stays inside normal UK handling rules and does not require a login to your estate.
Read the note
Quiet hours are not always good news
How to caption empty stretches on cybersecurity event charts so a quiet week is not mistaken for a clean week.
Read the note
Briefing the people who do not read logs
How to walk a mixed room through incident charts without turning the hour into a detector tutorial.
Read the note