BLUE TEAM – Page 3 – NetwerkLABS

SIEM Use cases

How To Build SIEM Use Cases Comprehend your needs, risks, and establish alerts for monitoring all necessary systems accordingly. Determine the priority and impact, then map the alert to the kill chain or MITRE framework. Establish…

Bharath Narayanasamy Usecase, SIEM, Elastic

BLUE TEAM Intrusion Detection and Response

Log Management: Basics

Introduction to Log Management Logs are a record of events within a system. These records provide a detailed account of what a system has been doing, capturing a wide range of events such as user logins,…

Bharath Narayanasamy

Splunk Splunk Basics Investigating with Splunk

Splunk: SPL Cheat Sheet for SOC Analysts

Splunk Cheat Sheet Query to identify failed login attempts: #Query to identify failed login attempts: sourcetype=auth* "authentication failure" | stats count by user | sort -count Query to identify privilege escalation attempts: #Query to identify privilege…

Bharath Narayanasamy SPL, splunk

Splunk

Splunk Fundamentals

Splunk Components Splunk Forwarder Splunk Forwarder is a lightweight agent installed on the endpoint intended to be monitored, and its main task is to collect the data and send it to the Splunk instance. Splunk Indexer Splunk…

Bharath Narayanasamy

BLUE TEAM Risk Management INFOSEC Governance and Regulation

Risk Assessment Methodologies

Risk Management Frameworks There are several frameworks for risk assessment. Example methodologies are: NIST SP 800-30: A risk assessment methodology developed by the National Institute of Standards and Technology (NIST). It involves identifying and evaluating risks,…

Bharath Narayanasamy Risk management, CISO, ISO 27001, NIST

BLUE TEAM Risk Management

Risk Management – Terminology

Risk Avoidance Risk Acceptance Risk Reduction Basic Terminology Threat: an intentional or accidental event that can compromise the security of an information system. Examples include hacking, phishing attacks, human error, and natural disasters. Vulnerability: a software,…

Bharath Narayanasamy NIST, Risk management, CISO, ISO 27001

BLUE TEAM Intrusion Detection and Response

Suricata rules to detect Web application attacks

Here are some examples of Suricata rules that can be used to detect web application attacks: 1. SQL Injection: alert http any any -> any any (msg:"SQL Injection Detected"; flow:established,to_server; content:"SELECT"; nocase; http_uri; pcre:"/(\%27)|(\')|(\-\-)|(\%23)|(#)/i"; classtype:web-application-attack; sid:100001;)…

Bharath Narayanasamy suricata

Security+

DNS Tunneling attacks

DNS tunneling is a technique used by attackers to bypass network security measures and exfiltrate data from a targeted network. It involves encapsulating unauthorized data within DNS (Domain Name System) queries or responses, allowing the attacker…

Bharath Narayanasamy attacks