DETECT – NetwerkLABS

SIEM: Onboarding WIndows Servers

When integrating Windows servers into your Security Information and Event Management (SIEM) platform, selecting the right log sources is crucial for effective threat detection while maintaining optimal system performance. This…

Bharath Narayanasamy

SOC Analyst BLUE TEAM Vulnerability Scanning

Vulnerability Management: FARADAY

Faraday: Open Source Vulnerability Manager Faraday is a powerful open-source vulnerability management platform designed to help cybersecurity teams streamline their pentesting, vulnerability assessment, and remediation processes. Built with a collaborative…

Bharath Narayanasamy

DETECT RESPOND DFIR

Wireshark 101 | Traffic Analysis and Investigation (PART 04)

Encrypted Protocol Analysis: Decrypting HTTPS When investigating web traffic, analysts often run across encrypted traffic. This is caused by using the Hypertext Transfer Protocol Secure (HTTPS) protocol for enhanced security…

zyberbkay

DETECT RESPOND IDENTIFY

Wireshark 101 | Traffic Analysis and Investigation (PART 03)

Investigate Tunnelling Traffic: ICMP and DNS Traffic tunnelling is (also known as "port forwarding") transferring the data/resources in a secure method to network segments and zones. It can be used for "internet…

zyberbkay

IDENTIFY DETECT RESPOND

Wireshark 101 | Traffic Analysis and Investigation (PART 02)

Identifying Hosts When investigating a compromise or malware infection activity, a security analyst should know how to identify the hosts on the network apart from IP to MAC address match.…

Bharath Narayanasamy

CyBER Tools Cyber Threat Intelligence and Advisory DETECT

Endpoint Detection and Response (EDR) : Lima Charlie (Part 01)

Introduction to Endpoint Detection and Response (EDR) Endpoint Detection and Response (EDR) is a cybersecurity solution designed to detect, investigate, and respond to threats at the endpoint level. Endpoints include…

Bharath Narayanasamy

DETECT PROTECT RESPOND

SNORT 101 (Part 03)

Snort Rules Each rule should have a type of action, protocol, source and destination IP, source and destination port and an option. Remember, Snort is in passive mode by default.…

Bharath Narayanasamy

DETECT RESPOND

SNORT 101 (Part 02)

SNORT in IDS/IPS mode IDS/IPS mode with parameter "-A" There are several alert modes available in snort; console: Provides fast style alerts on the console screen. cmg: Provides basic header details with payload…

Bharath Narayanasamy

Threat Detection and Incident Response Intrusion Detection and Response DETECT

Snort 101 (Part 01)

Intrusion Detection System (IDS) IDS is a passive monitoring solution for detecting possible malicious activities/patterns, abnormal incidents, and policy violations. It is responsible for generating alerts for each suspicious event. There…

Bharath Narayanasamy

Threat Detection and Incident Response RED TEAM DETECT

Operationalizing Security: CALDERA Meets WAZUH (PART II)

Adversary emulation with Caldera and Wazuh Please visit here to read PART I of this series, which explains the Caldera setup and Windows agent installation. Agent setup Deploy Agents on…

Bharath Narayanasamy