SIEM – NetwerkLABS

Importing the Wazuh 5.0 Beta OVA into Proxmox

Wazuh 5.0 is currently in beta, and the project also ships it as a ready-to-run OVA appliance. That's convenient if you just want to kick the tyres on the new release, but Proxmox doesn't import OVAs…

Bharath Narayanasamy wazuh, EDR, XDR, SIEM

DETECT MITRE ATT&CK Elastic SIEM

SIEM: Onboarding WIndows Servers

When integrating Windows servers into your Security Information and Event Management (SIEM) platform, selecting the right log sources is crucial for effective threat detection while maintaining optimal system performance. This comprehensive guide outlines the essential Windows…

Bharath Narayanasamy SIEM, Windows

wazuh

Wazuh: VirusTotal Integration

Wazuh Integration with VirusTotal Overview Wazuh integrates with VirusTotal to detect malicious files via the File Integrity Monitoring (FIM) module. This allows inspection of monitored files for potential threats. About VirusTotal Service Features: Analyzes files and…

Bharath Narayanasamy wazuh, virustotal, SIEM

Threat Hunting SOC Analyst Threat Detection and Incident Response

(TryHackMe) Servidae: Log Analysis in ELK

Link to the TryHackMe Room; https://tryhackme.com/r/room/servidae Room Objectives: Get familiar with the Elastic (ELK) Stack and its components. Understand the significance of log data analysis in detecting and investigating security incidents. Get introduced to Kibana and its key…

Bharath Narayanasamy SIEM, THM, ELK

Threat Hunting SOC Analyst Threat Detection and Incident Response

Splunk SIEM: Exploring SPL

Splunk Search & Reporting App Overview The Search & Reporting App is the primary interface on Splunk's Home page used for searching and analyzing data. This app provides several essential functionalities to enhance the search experience…

Bharath Narayanasamy splunk, SIEM

wazuh

Remotely Upgrading Wazuh Agents – CLI Method

To upgrade agents using the command line, use the agent_upgrade tool as follows: List all the agents with outdated software: /var/ossec/bin/agent_upgrade -l [root@wazuh-server wazuh-user]# /var/ossec/bin/agent_upgrade -lID Name Version 001 zyberpatrol-pdc Wazuh v4.7.1 Upgrade the agent with ID…

Bharath Narayanasamy SIEM, wazuh

Threat Hunting Threat Detection and Incident Response

Threat Detection: Detecting a Webserver Attack

LAB Setup Let's use the DIWA ( Deliberately Insecure Web Application) vulnerable created by Tim Steufmehl , to setup the victim machine. Prepare a Linux machiine with Docker installed. Follow the these instructions to install Docker on…

Bharath Narayanasamy SIEM, Elastic

DETECT Elastic SIEM

Elastic SIEM: Developing Dashboards & Visualization

Use case 1: Failed Logon Attempts (Disabled Users) https://youtu.be/7Uyqek-FdwI Use case 2: Failed Logon Attempts (using Admin Accounts) https://youtu.be/UGRmsoqk0EM Use case 3: Successful RDP Logon Related To Service Accounts https://youtu.be/eRjA6TpEryk Use case 4: Users Added Or…

Bharath Narayanasamy Threat_hunting, SIEM, Elastic

BLUE TEAM DETECT Elastic SIEM

SIEM Use cases

How To Build SIEM Use Cases Comprehend your needs, risks, and establish alerts for monitoring all necessary systems accordingly. Determine the priority and impact, then map the alert to the kill chain or MITRE framework. Establish…

Bharath Narayanasamy SIEM, Elastic, Usecase