Bharath Narayanasamy

Wireshark 101 | Traffic Analysis and Investigation (PART 02)

Identifying Hosts When investigating a compromise or malware infection activity, a security analyst should know how to identify the hosts on the network apart from IP to MAC address match. One of the best methods is…

Bharath Narayanasamy wireshark

DETECT DFIR

Wireshark 101 | Traffic Analysis and Investigation (PART 01)

Wireshark: Traffic Analysis Display Filter Reference Investigating Nmap scans Nmap is an industry-standard tool for mapping networks, identifying live hosts and discovering the services. As it is one of the most used network scanner tools, a security…

Bharath Narayanasamy wireshark

Security+

Endpoint Detection and Response (EDR) : Lima Charlie (Part 01)

Introduction to Endpoint Detection and Response (EDR) Endpoint Detection and Response (EDR) is a cybersecurity solution designed to detect, investigate, and respond to threats at the endpoint level. Endpoints include devices like laptops, desktops, servers, and…

Bharath Narayanasamy LIMA, EDR

DETECT PROTECT RESPOND

SNORT 101 (Part 03)

Snort Rules Each rule should have a type of action, protocol, source and destination IP, source and destination port and an option. Remember, Snort is in passive mode by default. So most of the time, we…

Bharath Narayanasamy snort

DETECT RESPOND

SNORT 101 (Part 02)

SNORT in IDS/IPS mode IDS/IPS mode with parameter "-A" There are several alert modes available in snort; console: Provides fast style alerts on the console screen. cmg: Provides basic header details with payload in hex and text format. full: Full…

Bharath Narayanasamy snort

CyBER Tools

Snort 101 (Part 01)

Intrusion Detection System (IDS) IDS is a passive monitoring solution for detecting possible malicious activities/patterns, abnormal incidents, and policy violations. It is responsible for generating alerts for each suspicious event. There are two main types of IDS systems; Network…

Bharath Narayanasamy snort, ids, ips

Splunk CyBER Tools

Splunk SIEM: Search Processing Language (SPL) Basics

Splunk Search Processing Language comprises of multiple functions, operators and commands that are used together to form a simple to complex search and get the desired results from the ingested logs. Main components of SPL Search…

Bharath Narayanasamy

Splunk CyBER Tools

Ship OPNSense Firewall Logs To Splunk SIEM

Shipping OPNsense firewall logs to Splunk centralizes log management, allowing for seamless consolidation with other network and system logs. This integration enhances visibility into network traffic, enabling the identification of threats like port scans, malware communication,…

Bharath Narayanasamy splink, OPNSense

Threat Intel DETECT wazuh

Wazuh: VirusTotal Integration

Wazuh Integration with VirusTotal Overview Wazuh integrates with VirusTotal to detect malicious files via the File Integrity Monitoring (FIM) module. This allows inspection of monitored files for potential threats. About VirusTotal Service Features: Analyzes files and…

Bharath Narayanasamy SIEM, wazuh, virustotal

Purple Teaming Detection Engineering RED TEAM

Operationalizing Security: CALDERA Meets WAZUH (PART II)

Adversary emulation with Caldera and Wazuh Please visit here to read PART I of this series, which explains the Caldera setup and Windows agent installation. Agent setup Deploy Agents on Linux machines Now, the lab consists…

Bharath Narayanasamy wazuh, caldera