CyBER Tools – NetwerkLABS

Atomic Red Team — Adversary Simulation and Detection

Full Kill Chain Simulation + Splunk Detection Dashboard Operation Silent Ledger | Northbridge Financial APT SimulationPurple Team Playbook: ART Execution → Splunk Detection → Custom Dashboard 🗺️ Kill Chain Map — Techniques We'll Simulate Kill Chain…

Bharath Narayanasamy splunk, detection_engineering, Atomic RED

CyBER Tools

SIEM: Onboarding WIndows Servers

When integrating Windows servers into your Security Information and Event Management (SIEM) platform, selecting the right log sources is crucial for effective threat detection while maintaining optimal system performance. This comprehensive guide outlines the essential Windows…

Bharath Narayanasamy SIEM, Windows

Splunk CyBER Tools

Data Manipulation in Splunk: PART II

Event Boundaries Event breaking in Splunk refers to breaking raw data into individual events based on specified boundaries. Splunk uses event-breaking rules to identify where one event ends, and the next begins. In the PART I of this series, we…

Bharath Narayanasamy splunk

Splunk CyBER Tools

Data Manipulation in Splunk: PART I

Splunk Log Parsing and Transformation Configuration Splunk needs to be properly configured to parse and transform the logs appropriately. Some of the issues being highlighted are: Event Breaking: Ensure Splunk correctly breaks events for proper indexing…

Bharath Narayanasamy splunk

CyBER Tools Splunk

Regular Expressions

Regular Expressions: Charsets Searching for Specific Strings Use grep 'string' <file> to search for an exact match. To find patterns rather than exact strings, Regular Expressions (regex) are used. Charsets in Regex Definition: Enclosed in […

Bharath Narayanasamy splunk

CyBER Tools

Snort 101 (Part 01)

Intrusion Detection System (IDS) IDS is a passive monitoring solution for detecting possible malicious activities/patterns, abnormal incidents, and policy violations. It is responsible for generating alerts for each suspicious event. There are two main types of IDS systems; Network…

Bharath Narayanasamy snort, ids, ips

Splunk CyBER Tools

Splunk SIEM: Search Processing Language (SPL) Basics

Splunk Search Processing Language comprises of multiple functions, operators and commands that are used together to form a simple to complex search and get the desired results from the ingested logs. Main components of SPL Search…

Bharath Narayanasamy

Splunk CyBER Tools

Ship OPNSense Firewall Logs To Splunk SIEM

Shipping OPNsense firewall logs to Splunk centralizes log management, allowing for seamless consolidation with other network and system logs. This integration enhances visibility into network traffic, enabling the identification of threats like port scans, malware communication,…

Bharath Narayanasamy splink, OPNSense

CyBER Tools

(TryHackMe) Servidae: Log Analysis in ELK

Link to the TryHackMe Room; https://tryhackme.com/r/room/servidae Room Objectives: Get familiar with the Elastic (ELK) Stack and its components. Understand the significance of log data analysis in detecting and investigating security incidents. Get introduced to Kibana and its key…

Bharath Narayanasamy SIEM, THM, ELK

CyBER Tools

Log Analysis: Basics

Understanding Logs in Infrastructure Systems Logs and Their Role Logs are time-sequenced messages recording events within a system, device, or application. Essential for insights into the inner workings of infrastructure systems, offering visibility into applications, networks,…

Bharath Narayanasamy