threat_detection – NetwerkLABS

OpenCTI – Open Source Threat Intelligence Platform: PART I

OpenCTI (Open Cyber Threat Intelligence Platform) is a powerful open-source solution designed to help security teams collect, store, organize, and visualize threat intelligence in a structured way. Whether you’re a SOC analyst, threat hunter, or security…

Bharath Narayanasamy Threat Intel, threat_detection, OpenCTI

DFIR

Hunting the hunters: DFIR with Velociraptor (PART-II)

We covered the deployment of Velociraptor Server and Client components in the first part of this series. You can read it here if you're interested. This part of the series will walk you through the capabilities…

Bharath Narayanasamy threat_detection, dfir, Velociraptor

Threat Hunting Threat Detection and Incident Response Understanding Log Sources

Useful Windows Event IDs

Windows System Logs Event ID 1074 (System Shutdown/Restart): This event log indicates when and why the system was shut down or restarted. By monitoring these events, you can determine if there are unexpected shutdowns or restarts, potentially…

Bharath Narayanasamy threat_detection, event-ids

Threat Intelligence

Threat Intelligence for SOC

Threat Intelligence is the analysis of data and information using tools and techniques to generate meaningful patterns to mitigate against potential risks associated with existing or emerging threats targeting organisations, industries, sectors or governments. There are…

Bharath Narayanasamy Threat Intel, threat_detection

Threat Intelligence

Detection Engineering vs Threat Hunting

DETECTION ENGINEERING: REINFORCING THE KNOWN Threat detection is the process of identifying threats in an organization that is actively trying to attack the endpoints, networks, devices and systems. Unlike threat hunting, a threat detection is a…

Bharath Narayanasamy threat_detection, detection_engineering

DETECT Traffic Analysis Threat Hunting

Netminer

NetworkMiner CapabilityDescriptionTraffic sniffingIt can intercept the traffic, sniff it, and collect and log packets that pass through the network.Parsing PCAP filesIt can parse pcap files and show the content of the packets in detail.Protocol analysisIt can identify the…

Bharath Narayanasamy Threat_hunting, threat_detection, netminer, dfir

Traffic Analysis SOC Analyst Threat Detection and Incident Response

Introduction to Network Forensics

Source: Tryhackme Networkminer room Introduction to Network Forensics Network Forensics is a specific subdomain of the Forensics domain, and it focuses on network traffic investigation. Network Forensics discipline covers the work done to access information transmitted…

Bharath Narayanasamy networkminer, traffic_analysis, threat_detection, dfir, BLUE