(TryHackMe) Servidae: Log Analysis in ELK

This entry is part 1 of 3 in the series TryHackMe

Views: 86Link to the TryHackMe Room; https://tryhackme.com/r/room/servidae Room Objectives: In this room, we will analyze the log data from a compromised workstation using the Kibana interface. Within this room’s tasks, we will explore the components of the Elastic (ELK) Stack and gain insights into the various search and filter functions available in Kibana. Our ultimate … Read more

Threat Detection Engineering

TD_003
This entry is part 19 of 21 in the series Threat Detection Engineering

Views: 10Threat Detection Engineering (TDE) involves designing, implementing, and refining security measures to identify and respond to threats. Here are some key topics and domains covered under TDE: These areas are essential in building a robust threat detection engineering program that keeps up with evolving threats.

Log Analysis: Basics

This entry is part 18 of 21 in the series Threat Detection Engineering

Views: 40Understanding Logs in Infrastructure Systems Logs and Their Role Log Analysis What Are Logs? Definition Log Entry Components Sample Log Analysis Importance of Logs 1. System Troubleshooting 2. Cybersecurity Incident Response 3. Threat Hunting 4. Compliance Types of Logs in Computing Environments Integrative Analysis Data Visualization Data visualization tools, such as Kibana (of the … Read more

Splunk SIEM: Exploring SPL

This entry is part 17 of 21 in the series Threat Detection Engineering

Views: 14Splunk Search & Reporting App Overview The Search & Reporting App is the primary interface on Splunk’s Home page used for searching and analyzing data. This app provides several essential functionalities to enhance the search experience for analysts. Search & Reporting App is the default interface used to search and analyze the data on the Splunk Home … Read more

Threat Intelligence with MISP: Part 1 – Setting up MISP with Docker

This entry is part 16 of 21 in the series Threat Detection Engineering

Views: 99Step-by-Step Guide to Install MISP Using Docker on Ubuntu In this guide, we will walk through the steps to install the MISP (Malware Information Sharing Platform) using Docker on an Ubuntu server. Prerequisites Before we begin, make sure your system meets the following requirements: Step 1: Update Your Server and Install Docker First, ensure … Read more