Bharath Narayanasamy

BLUE TEAM

Pyramid of Pain

Bharath Narayanasamy

SOC Analyst Threat Detection and Incident Response

MISP (Malware Information Sharing Platform)

MISP

Bharath Narayanasamy MISP

SOC Analyst

SOC Home LAB: Elastic SIEM Installation

Deploy Elastic Security

Bharath Narayanasamy

Threat Detection and Incident Response

Incident Report Template

Elements of an incident report Source: Hack The Box Incident Report Template

Bharath Narayanasamy IR, Incident_Response

SOC Analyst Threat Detection and Incident Response DETECT

Understanding Windows Event Logs Each entry in the Windows Event Log is an "Event" and contains the following primary components: Log Name: The name of the event log (e.g., Application, System, Security, etc.). Source: The software…

Bharath Narayanasamy eventlogs, eventid

DFIR Threat Detection and Incident Response DETECT

Wireshark 101 | Packet Operations

Wireshark: Packet Operations Statistics | Summary This menu provides multiple statistics options ready to investigate to help users see the big picture in terms of the scope of the traffic, available protocols, endpoints and conversations, and…

Bharath Narayanasamy wireshark

SOC Analyst

SOC Tools and Useful Links

1- IP & URL Reputation 1. Virus Total : https://www.virustotal.com/gui/home/upload2. URL Scan : https://urlscan.io/3. AbuseIPDB: https://www.abuseipdb.com/4. Cisco Talos: https://www.talosintelligence.com/5. IBM X-Force: https://lnkd.in/gt8iyHE56. URL Filtering(Palo Alto): https://lnkd.in/e4bkm5Eq7. URL Filtering(Symantec): https://lnkd.in/g4qQGsHG8. IP Void: https://www.ipvoid.com/9. URL Void: https://www.urlvoid.com/ 2- File | Hash | Search | Analysis | Sandboxing…

Bharath Narayanasamy SOC Tools

SOC Analyst Threat Detection and Incident Response DETECT

ELASTIC SIEM: Kibana Query Language (KQL)

Different Syntax Languages Kibana supports two types of syntax languages for querying in Kibana: KQL (Kibana Query Language) and Lucene Query Syntax. Kibana Query Language (KQL) is a user-friendly query language developed by Elastic specifically for Kibana. It provides autocomplete suggestions…

Bharath Narayanasamy kibana, KQL, wazuh

MITRE ATT&CK

MITRE Framework

MITRE ATT&CK Navigator https://mitre-attack.github.io/attack-navigator MITRE D3FEND https://d3fend.mitre.org MITRE ENGAGE MITRE Engage MITRE Engage Matrix ATT&CK Emulation Plans https://mitre-engenuity.org Center of Threat-Informed Defense (CTID) Cyber Analytics Repository https://car.mitre.org

Bharath Narayanasamy MITRE

Attacking Active Directory

GOAD v2 Installation

Game Of Active Directory The following steps explain the procedure to setup the GOADv2 LAB environment to pentest Active Directory. Warning This lab is extremely vulnerable, do not reuse recipe to build your environment and do not…

Bharath Narayanasamy AD², AD