BLUE TEAM – NetwerkLABS

SIEM: Onboarding WIndows Servers

When integrating Windows servers into your Security Information and Event Management (SIEM) platform, selecting the right log sources is crucial for effective threat detection while maintaining optimal system performance. This…

Bharath Narayanasamy

SOC Analyst BLUE TEAM Vulnerability Scanning

Vulnerability Management: FARADAY

Faraday: Open Source Vulnerability Manager Faraday is a powerful open-source vulnerability management platform designed to help cybersecurity teams streamline their pentesting, vulnerability assessment, and remediation processes. Built with a collaborative…

Bharath Narayanasamy

Splunk Basics Splunk

Data Manipulation in Splunk: PART II

Event Boundaries Event breaking in Splunk refers to breaking raw data into individual events based on specified boundaries. Splunk uses event-breaking rules to identify where one event ends, and the next begins. In the…

Bharath Narayanasamy

Splunk Splunk Basics

Data Manipulation in Splunk: PART I

Splunk Log Parsing and Transformation Configuration Splunk needs to be properly configured to parse and transform the logs appropriately. Some of the issues being highlighted are: Event Breaking: Ensure Splunk…

Bharath Narayanasamy

SOC Analyst Splunk Threat Hunting

Regular Expressions

Regular Expressions: Charsets Searching for Specific Strings Use grep 'string' <file> to search for an exact match. To find patterns rather than exact strings, Regular Expressions (regex) are used. Charsets…

Bharath Narayanasamy

DETECT RESPOND DFIR

Wireshark 101 | Traffic Analysis and Investigation (PART 04)

Encrypted Protocol Analysis: Decrypting HTTPS When investigating web traffic, analysts often run across encrypted traffic. This is caused by using the Hypertext Transfer Protocol Secure (HTTPS) protocol for enhanced security…

zyberbkay

DETECT RESPOND IDENTIFY

Wireshark 101 | Traffic Analysis and Investigation (PART 03)

Investigate Tunnelling Traffic: ICMP and DNS Traffic tunnelling is (also known as "port forwarding") transferring the data/resources in a secure method to network segments and zones. It can be used for "internet…

zyberbkay

IDENTIFY DETECT RESPOND

Wireshark 101 | Traffic Analysis and Investigation (PART 02)

Identifying Hosts When investigating a compromise or malware infection activity, a security analyst should know how to identify the hosts on the network apart from IP to MAC address match.…

Bharath Narayanasamy

CyBER Tools Cyber Threat Intelligence and Advisory DETECT

Endpoint Detection and Response (EDR) : Lima Charlie (Part 01)

Introduction to Endpoint Detection and Response (EDR) Endpoint Detection and Response (EDR) is a cybersecurity solution designed to detect, investigate, and respond to threats at the endpoint level. Endpoints include…

Bharath Narayanasamy

DETECT PROTECT RESPOND

SNORT 101 (Part 03)

Snort Rules Each rule should have a type of action, protocol, source and destination IP, source and destination port and an option. Remember, Snort is in passive mode by default.…

Bharath Narayanasamy