Series: Threat Detection Engineering

A practical course on Threat Detection Engineering using Elastic SIEM/EDR

Windows Security Log Quick Reference

by
This entry is part 20 of 27 in the series Threat Detection Engineering

Views: 3🛡️ For Cybersecurity Defensive Operations and IR/Threat Hunting 🔐 Authentication Events 🗝️ Account Management Events 📂 Object Access Events ✅ Note: Requires enabling object auditing via GPO and SACLs. 🧰 Privilege Use and Logon Types PRO Tip: Use Logon Type + Event 4624/4625 to spot RDP logins, scheduled tasks, or lateral movement attempts. ⚙️ … Read more

OpenCTI – Open Source Threat Intelligence Platform: PART I

by
This entry is part 21 of 27 in the series Threat Detection Engineering

Views: 18OpenCTI (Open Cyber Threat Intelligence Platform) is a powerful open-source solution designed to help security teams collect, store, organize, and visualize threat intelligence in a structured way. Whether you’re a SOC analyst, threat hunter, or security researcher, OpenCTI provides a unified environment to centralize CTI data, correlate intelligence from multiple sources, and share it … Read more