BLUE TEAM – Page 2 – NetwerkLABS

Risk Management INFOSEC Governance and Regulation

Digital Operational Resilience Act (DORA)

Understanding the Digital Operational Resilience Act (DORA): A Comprehensive Overview In an era where digitalization permeates every aspect of our lives, the importance of cybersecurity and operational resilience has never been more critical. The European Union's…

Bharath Narayanasamy DORA

BLUE TEAM

Pyramid of Pain

Bharath Narayanasamy

Intrusion Detection and Response DETECT SOC Analyst

DFIR: Linux File System Analysis

Bharath Narayanasamy incident response, detection, dfir, linux

Splunk

Splunk SPL 101

Bharath Narayanasamy splunk, SPL

Elastic SIEM Threat Hunting Threat Detection and Incident Response

Practical Threat Hunting using Elastic SIEM: Hunting for Stuxbot

Based on the INTRODUCTION TO THREAT HUNTING & HUNTING WITH ELASTIC module from HTB-Academy Hunting for Stuxbot The Stuxbot cybercrime group operates with a broad scope, seizing upon opportunities as they arise, without any specific targeting…

Bharath Narayanasamy Elastic, Threat_hunting

BLUE TEAM DETECT Traffic Analysis

Netminer

NetworkMiner CapabilityDescriptionTraffic sniffingIt can intercept the traffic, sniff it, and collect and log packets that pass through the network.Parsing PCAP filesIt can parse pcap files and show the content of the packets in detail.Protocol analysisIt can identify the…

Bharath Narayanasamy Threat_hunting, threat_detection, netminer, dfir

DETECT Traffic Analysis SOC Analyst

Introduction to Network Forensics

Source: Tryhackme Networkminer room Introduction to Network Forensics Network Forensics is a specific subdomain of the Forensics domain, and it focuses on network traffic investigation. Network Forensics discipline covers the work done to access information transmitted…

Bharath Narayanasamy BLUE, networkminer, traffic_analysis, threat_detection, dfir

BLUE TEAM DETECT

Wireshark: 802.11 Denial of Service

Bharath Narayanasamy wireshark, wifi, 802.11

DETECT Threat Detection and Incident Response BLUE TEAM

Analysis with Wireshark

TShark VS. Wireshark (Terminal vs. GUI) TShark is a purpose-built terminal tool based on Wireshark. TShark shares many of the same features that are included in Wireshark and even shares syntax and options. TShark is perfect…

Bharath Narayanasamy wireshark

DETECT Elastic SIEM

Elastic SIEM: Developing Dashboards & Visualization

Use case 1: Failed Logon Attempts (Disabled Users) https://youtu.be/7Uyqek-FdwI Use case 2: Failed Logon Attempts (using Admin Accounts) https://youtu.be/UGRmsoqk0EM Use case 3: Successful RDP Logon Related To Service Accounts https://youtu.be/eRjA6TpEryk Use case 4: Users Added Or…

Bharath Narayanasamy SIEM, Elastic, Threat_hunting