Onion Infosec https://www.onioninfosec.com/resources Onion Infosec (Onion Information Security Solutions Private Limited) is a technology and cybersecurity company headquartered in Mumbai, India. It provides cybersecurity, AI, software development, cloud, IT, OT security and managed services, and develops its own security products. en Sun, 20 Sep 2026 00:00:00 GMT Why security operations need context, not more alerts https://www.onioninfosec.com/resources/blog/why-security-operations-need-context https://www.onioninfosec.com/resources/blog/why-security-operations-need-context Sun, 20 Sep 2026 00:00:00 GMT Why alert volume says little about SOC outcomes, what context an analyst needs to decide quickly, and how to measure triage without counting alerts. Security Operations Building a practical cloud security monitoring strategy https://www.onioninfosec.com/resources/blog/cloud-security-monitoring-strategy https://www.onioninfosec.com/resources/blog/cloud-security-monitoring-strategy Sun, 20 Sep 2026 00:00:00 GMT A practical order of work for cloud security monitoring on AWS, Azure and Google Cloud, from control plane logs to detections, cost control and response. Cloud Security Detection engineering: turning security telemetry into action https://www.onioninfosec.com/resources/blog/detection-engineering-telemetry-to-action https://www.onioninfosec.com/resources/blog/detection-engineering-telemetry-to-action Sun, 20 Sep 2026 00:00:00 GMT How to run detections as code, from an ATT&CK hypothesis through a tested KQL rule to tuning and analyst notes, with a worked Microsoft Sentinel example. Detection Engineering From VAPT findings to continuous security improvement https://www.onioninfosec.com/resources/blog/from-vapt-findings-to-continuous-improvement https://www.onioninfosec.com/resources/blog/from-vapt-findings-to-continuous-improvement Sun, 20 Sep 2026 00:00:00 GMT How to read a VAPT report, prioritize with CVSS, EPSS and CISA KEV, fix root causes, and feed findings into development, detection and the next test. Offensive Security OAuth abuse and modern identity threats https://www.onioninfosec.com/resources/blog/oauth-abuse-and-modern-identity-threats https://www.onioninfosec.com/resources/blog/oauth-abuse-and-modern-identity-threats Sun, 20 Sep 2026 00:00:00 GMT How attackers get past MFA by stealing tokens and abusing OAuth consent in Microsoft Entra ID, which logs record it and how to respond when it happens. Identity & Access Practical threat hunting in Microsoft security environments https://www.onioninfosec.com/resources/blog/threat-hunting-in-microsoft-security-environments https://www.onioninfosec.com/resources/blog/threat-hunting-in-microsoft-security-environments Sun, 20 Sep 2026 00:00:00 GMT A practical method for threat hunting in Microsoft Defender XDR and Microsoft Sentinel, with two KQL examples and guidance on recording every outcome. Threat Hunting Security governance without turning compliance into paperwork https://www.onioninfosec.com/resources/blog/security-governance-without-the-paperwork https://www.onioninfosec.com/resources/blog/security-governance-without-the-paperwork Sun, 20 Sep 2026 00:00:00 GMT How to build security governance on real operations: one mapped control library, evidence from daily work, and a risk register that drives decisions. Compliance & Governance Security telemetry: what organizations should actually monitor https://www.onioninfosec.com/resources/blog/security-telemetry-what-to-monitor https://www.onioninfosec.com/resources/blog/security-telemetry-what-to-monitor Sun, 20 Sep 2026 00:00:00 GMT A priority order for security log sources, from identity and endpoint to cloud audit and SaaS, with guidance on retention, cost and log health monitoring. Security Operations What good incident response looks like before the incident https://www.onioninfosec.com/resources/blog/incident-response-before-the-incident https://www.onioninfosec.com/resources/blog/incident-response-before-the-incident Sun, 20 Sep 2026 00:00:00 GMT What to prepare before a security incident: decision authority, contacts, log retention, evidence handling, playbooks, exercises and tested backups. Incident Response A working threat model for LLM applications https://www.onioninfosec.com/resources/blog/threat-model-for-llm-applications https://www.onioninfosec.com/resources/blog/threat-model-for-llm-applications Sat, 19 Sep 2026 00:00:00 GMT A practical threat model for applications built on large language models, covering trust boundaries, the main threats and the controls that limit them. AI & Security Running ISO/IEC 27001:2022 and SOC 2 from one control set https://www.onioninfosec.com/resources/blog/iso-27001-and-soc-2-one-control-set https://www.onioninfosec.com/resources/blog/iso-27001-and-soc-2-one-control-set Sat, 19 Sep 2026 00:00:00 GMT How to satisfy ISO/IEC 27001:2022 and SOC 2 with one set of controls and one body of evidence, and where the two still differ. Compliance & Governance Segmenting IT from OT with the Purdue model and IEC 62443 https://www.onioninfosec.com/resources/blog/it-ot-segmentation-purdue-iec-62443 https://www.onioninfosec.com/resources/blog/it-ot-segmentation-purdue-iec-62443 Sat, 19 Sep 2026 00:00:00 GMT A practical guide to separating IT from OT networks using the Purdue levels, IEC 62443 zones and conduits, an industrial DMZ and passive discovery. OT Security