Threat Detection and Incident Response – Page 2

SOC Analyst Threat Detection and Incident Response

MISP (Malware Information Sharing Platform)

MISP

Bharath Narayanasamy

Threat Detection and Incident Response

Incident Report Template

Elements of an incident report Source: Hack The Box Incident Report Template

Bharath Narayanasamy

SOC Analyst Threat Detection and Incident Response DETECT

Windows Event Logs

Understanding Windows Event Logs Each entry in the Windows Event Log is an "Event" and contains the following primary components: Log Name: The name of the event log (e.g., Application,…

Bharath Narayanasamy

Threat Detection and Incident Response DETECT Traffic Analysis

Wireshark 101 | Packet Operations

Wireshark: Packet Operations Statistics | Summary This menu provides multiple statistics options ready to investigate to help users see the big picture in terms of the scope of the traffic,…

Bharath Narayanasamy

SOC Analyst Threat Detection and Incident Response DETECT

ELASTIC SIEM: Kibana Query Language (KQL)

Different Syntax Languages Kibana supports two types of syntax languages for querying in Kibana: KQL (Kibana Query Language) and Lucene Query Syntax. Kibana Query Language (KQL) is a user-friendly query language developed by Elastic…

Bharath Narayanasamy

Threat Hunting Threat Detection and Incident Response

Threat Detection: Detecting a Webserver Attack

LAB Setup Let's use the DIWA ( Deliberately Insecure Web Application) vulnerable created by Tim Steufmehl , to setup the victim machine. Prepare a Linux machiine with Docker installed. Follow the…

Bharath Narayanasamy

SOC Analyst Threat Detection and Incident Response Intrusion Detection and Response

DFIR: Linux File System Analysis

Bharath Narayanasamy

Threat Hunting Threat Detection and Incident Response Elastic SIEM

Practical Threat Hunting using Elastic SIEM: Hunting for Stuxbot

Based on the INTRODUCTION TO THREAT HUNTING & HUNTING WITH ELASTIC module from HTB-Academy Hunting for Stuxbot The Stuxbot cybercrime group operates with a broad scope, seizing upon opportunities as…

Bharath Narayanasamy

Threat Hunting SOC Analyst Threat Detection and Incident Response

Netminer

NetworkMiner CapabilityDescriptionTraffic sniffingIt can intercept the traffic, sniff it, and collect and log packets that pass through the network.Parsing PCAP filesIt can parse pcap files and show the content of the packets…

Bharath Narayanasamy

SOC Analyst Threat Detection and Incident Response BLUE TEAM

Introduction to Network Forensics

Source: Tryhackme Networkminer room Introduction to Network Forensics Network Forensics is a specific subdomain of the Forensics domain, and it focuses on network traffic investigation. Network Forensics discipline covers the…

Bharath Narayanasamy