Analysis with Wireshark
TShark VS. Wireshark (Terminal vs. GUI) TShark is a purpose-built terminal tool based on Wireshark. TShark shares many of the same features that are included in Wireshark and even shares…
Posted inCheat Sheets IDENTIFY DETECT
TCPDump
Locate tcpdump which tcpdump Install TCPdump sudo apt install tcpdump Tcpdump Version Validation sudo tcpdump --version TCPDump will resolve IPs to hostnames by default. Traffic Captures with Tcpdump Basic Capture…
Posted inDETECT Elastic SIEM
Elastic SIEM: Developing Dashboards & Visualization
Use case 1: Failed Logon Attempts (Disabled Users) https://youtu.be/7Uyqek-FdwI Use case 2: Failed Logon Attempts (using Admin Accounts) https://youtu.be/UGRmsoqk0EM Use case 3: Successful RDP Logon Related To Service Accounts https://youtu.be/eRjA6TpEryk…
Posted inBLUE TEAM DETECT Elastic SIEM
SIEM Use cases
How To Build SIEM Use Cases Comprehend your needs, risks, and establish alerts for monitoring all necessary systems accordingly. Determine the priority and impact, then map the alert to the…
Log Management: Basics
Introduction to Log Management Logs are a record of events within a system. These records provide a detailed account of what a system has been doing, capturing a wide range…
NIST – IDENTIFY: Categories and Subcategories
Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to business objectives…
Posted inNIST
NIST Cybersecurity Framework v1.1: Fundamentals
NIST Functions Identify – Understand what you have and includes activities such as asset management, governance, risk assessment. Protect – Build safeguards and controls to protect what is important to…
Posted inSplunk Splunk Basics Investigating with Splunk
Splunk: SPL Cheat Sheet for SOC Analysts
Splunk Cheat Sheet Query to identify failed login attempts: #Query to identify failed login attempts: sourcetype=auth* "authentication failure" | stats count by user | sort -count Query to identify privilege…
Posted inSplunk
Splunk Fundamentals
Splunk Components Splunk Forwarder Splunk Forwarder is a lightweight agent installed on the endpoint intended to be monitored, and its main task is to collect the data and send it to…