Threat Detection Engineering

SOC Analyst

SOC Home LAB: Elastic SIEM Installation

Deploy Elastic Security

Bharath Narayanasamy

Threat Detection and Incident Response DETECT SOC Analyst

Windows Event Logs

Understanding Windows Event Logs Each entry in the Windows Event Log is an "Event" and contains the following primary components: Log Name: The name of the event log (e.g., Application, System, Security, etc.). Source: The software…

Bharath Narayanasamy eventlogs, eventid

SOC Analyst Threat Detection and Incident Response

MISP (Malware Information Sharing Platform)

MISP

Bharath Narayanasamy MISP

CyBER Tools

Useful Windows Event IDs

Windows System Logs Event ID 1074 (System Shutdown/Restart): This event log indicates when and why the system was shut down or restarted. By monitoring these events, you can determine if there are unexpected shutdowns or restarts, potentially…

Bharath Narayanasamy threat_detection, event-ids

SOC Analyst BLUE TEAM DETECT

Yara

"The pattern matching swiss knife for malware researchers (and everyone else)" Useful Yara Resources Various Github repositories provide a wealth of examples of YARA, https://github.com/Yara-Rules/rules/tree/master/malware https://github.com/mikesxrs/Open-Source-YARA-rules/tree/masterUseful Yara Rules Repositories The DFIR Report” shares YARA rules derived from…

Bharath Narayanasamy SOC, yara

CyBER Tools

Threat Intelligence with MISP: Part 1 – Setting up MISP with Docker

Step-by-Step Guide to Install MISP Using Docker on Ubuntu In this guide, we will walk through the steps to install the MISP (Malware Information Sharing Platform) using Docker on an Ubuntu server. Prerequisites Before we begin,…

Bharath Narayanasamy Threat Intel, MISP

CyBER Tools Splunk

Splunk SIEM: Exploring SPL

Splunk Search & Reporting App Overview The Search & Reporting App is the primary interface on Splunk's Home page used for searching and analyzing data. This app provides several essential functionalities to enhance the search experience…

Bharath Narayanasamy splunk, SIEM

CyBER Tools

Log Analysis: Basics

Understanding Logs in Infrastructure Systems Logs and Their Role Logs are time-sequenced messages recording events within a system, device, or application. Essential for insights into the inner workings of infrastructure systems, offering visibility into applications, networks,…

Bharath Narayanasamy

Threat Hunting SOC Analyst Threat Detection and Incident Response

Threat Detection Engineering (TDE) involves designing, implementing, and refining security measures to identify and respond to threats. Here are some key topics and domains covered under TDE: Threat Intelligence: Gathering, analyzing, and applying information about current…

Bharath Narayanasamy THreat, TDE

CyBER Tools

SIEM: Onboarding WIndows Servers

When integrating Windows servers into your Security Information and Event Management (SIEM) platform, selecting the right log sources is crucial for effective threat detection while maintaining optimal system performance. This comprehensive guide outlines the essential Windows…

Bharath Narayanasamy SIEM, Windows