Data Manipulation in Splunk: PART I

This entry is part 9 of 4 in the series Splunk 101

Views: 14Splunk Log Parsing and Transformation Configuration Splunk needs to be properly configured to parse and transform the logs appropriately. Some of the issues being highlighted are: Splunk Data Parsing Guide Data parsing in Splunk involves extracting relevant fields and transforming the data into a structured format for efficient analysis. Step 1: Understand the Data … Read more

Regular Expressions

This entry is part 8 of 4 in the series Splunk 101

Views: 8Regular Expressions: Charsets Searching for Specific Strings Charsets in Regex Using Ranges Matching and Excluding Patterns Important Notes Regular Expressions: Wildcards and Optional Characters Wildcard Matching (. Dot) Optional Characters (? Question Mark) Matching a Literal Dot (\.) Regular Expressions: Line Anchors and Grouping Line Anchors Important Note: Grouping and Either/Or (|) Repeating Groups … Read more

Active Directory Domain Service (AD DS)

This entry is part 4 of 4 in the series Attack and Defend Active Directory

Views: 10 Overview Users Machines Security Groups Security Group Description Domain Admins Full control over the domain. Server Operators Can manage Domain Controllers but not admin groups. Backup Operators Can access any file for backup purposes. Account Operators Can create/modify user accounts. Domain Users Includes all user accounts. Domain Computers Includes all machines in the … Read more

GRC 101: SimpleRisk Core (Community Edition)

This entry is part 1 of 4 in the series Governance Risk Compliance

Views: 25What is SimpleRisk CORE (Community Edition)? SimpleRisk CORE (Community Edition) is an open-source Governance, Risk, and Compliance (GRC) tool designed to help organizations identify, assess, and manage risks effectively. It provides a structured framework for risk tracking, mitigation planning, and reporting, making it an excellent choice for small to medium businesses, startups, and cybersecurity … Read more

Concepts of Forensic Imaging

This entry is part 1 of 4 in the series Digital Forensics and Incident Response

Views: 13Core Concepts The process of imaging a disk starts by identifying the target drive, preparing it for imaging, and then creating the image file which is later verified for integrity. This needs to be performed in an environment that allows us to perform these tasks and also ensures the process is properly logged. Each … Read more

Wireshark 101 | Traffic Analysis and Investigation (PART 02)

This entry is part 14 of 17 in the series Incident Response and Forensics

Views: 5Identifying Hosts When investigating a compromise or malware infection activity, a security analyst should know how to identify the hosts on the network apart from IP to MAC address match. One of the best methods is identifying the hosts and users on the network to decide the investigation’s starting point and list the hosts … Read more

Endpoint Detection and Response (EDR) : Lima Charlie (Part 01)

This entry is part 1 of 1 in the series Endpoint Detection and Response (EDR)

Views: 18Introduction to Endpoint Detection and Response (EDR) Endpoint Detection and Response (EDR) is a cybersecurity solution designed to detect, investigate, and respond to threats at the endpoint level. Endpoints include devices like laptops, desktops, servers, and mobile devices that connect to an organization’s network. These are often the primary targets for attackers, making them … Read more

SNORT 101 (Part 03)

This entry is part 13 of 4 in the series Instrusion Detection and Prevention

Views: 21Snort Rules Each rule should have a type of action, protocol, source and destination IP, source and destination port and an option. Remember, Snort is in passive mode by default. So most of the time, we will use Snort as an IDS. We will need to start “inline mode” to turn on IPS mode.  The Snort rule structure … Read more

SNORT 101 (Part 02)

This entry is part 14 of 4 in the series Instrusion Detection and Prevention

Views: 1SNORT in IDS/IPS mode IDS/IPS mode with parameter “-A” There are several alert modes available in snort; Only the “console” and “cmg” parameters provide alert information in the console. It is impossible to identify the difference between the rest of the alert modes via terminal. Differences can be identified by looking at generated logs.  IDS/IPS mode with parameter “-A console” … Read more

 Ship OPNSense Firewall Logs To Splunk SIEM

Views: 105Shipping OPNsense firewall logs to Splunk centralizes log management, allowing for seamless consolidation with other network and system logs. This integration enhances visibility into network traffic, enabling the identification of threats like port scans, malware communication, or brute force attacks. By correlating OPNsense logs with logs from other sources, organizations can perform faster root … Read more