2024 – Page 2 – NetwerkLABS

Ship OPNSense Firewall Logs To Splunk SIEM

Shipping OPNsense firewall logs to Splunk centralizes log management, allowing for seamless consolidation with other network and system logs. This integration enhances visibility into network traffic, enabling the identification of…

Bharath Narayanasamy

wazuh

Wazuh: VirusTotal Integration

Wazuh Integration with VirusTotal Overview Wazuh integrates with VirusTotal to detect malicious files via the File Integrity Monitoring (FIM) module. This allows inspection of monitored files for potential threats. About…

Bharath Narayanasamy

Threat Detection and Incident Response RED TEAM DETECT

Operationalizing Security: CALDERA Meets WAZUH (PART II)

Adversary emulation with Caldera and Wazuh Please visit here to read PART I of this series, which explains the Caldera setup and Windows agent installation. Agent setup Deploy Agents on…

Bharath Narayanasamy

RED TEAM

Operationalizing Security: CALDERA Meets WAZUH (PART I)

CALDERA™ is an open-source framework designed to run autonomous adversary emulation exercises efficiently. It enables users to emulate real-world attack scenarios and assess the effectiveness of their security defences. In addition,…

Bharath Narayanasamy

Threat Hunting SOC Analyst Threat Detection and Incident Response

(TryHackMe) Servidae: Log Analysis in ELK

Link to the TryHackMe Room; https://tryhackme.com/r/room/servidae Room Objectives: Get familiar with the Elastic (ELK) Stack and its components. Understand the significance of log data analysis in detecting and investigating security…

Bharath Narayanasamy

Threat Hunting SOC Analyst Threat Detection and Incident Response

Threat Detection Engineering

Threat Detection Engineering (TDE) involves designing, implementing, and refining security measures to identify and respond to threats. Here are some key topics and domains covered under TDE: Threat Intelligence: Gathering,…

Bharath Narayanasamy

Threat Hunting SOC Analyst Intrusion Detection and Response

Log Analysis: Basics

Understanding Logs in Infrastructure Systems Logs and Their Role Logs are time-sequenced messages recording events within a system, device, or application. Essential for insights into the inner workings of infrastructure…

Bharath Narayanasamy

Threat Hunting SOC Analyst Threat Detection and Incident Response

Splunk SIEM: Exploring SPL

Splunk Search & Reporting App Overview The Search & Reporting App is the primary interface on Splunk's Home page used for searching and analyzing data. This app provides several essential…

Bharath Narayanasamy

DETECT Cyber Threat Intelligence and Advisory Threat Hunting

Threat Intelligence with MISP: Part 1 – Setting up MISP with Docker

Step-by-Step Guide to Install MISP Using Docker on Ubuntu In this guide, we will walk through the steps to install the MISP (Malware Information Sharing Platform) using Docker on an…

Bharath Narayanasamy

DETECT Threat Hunting Threat Detection and Incident Response

Useful Windows Event IDs

Windows System Logs Event ID 1074 (System Shutdown/Restart): This event log indicates when and why the system was shut down or restarted. By monitoring these events, you can determine if there…

Bharath Narayanasamy