Passive DNS Explained: A Practical Guide for Threat Hunters
What is passive DNS and why does it matter for threat hunting? A practical breakdown plus how to set up your own passivedns collector.
SIEM
Actively monitor pfsence firewall. PFELK: Elastic stack for pfsence
You will notice that this article has something to do with ELK stack AGAIN!!!. ELK stack is so flexible that it can fit into many different use cases. Today’s use-case of elk stack will be with the firewall. Most firewalls hardly have any kind of dashboard integrated with them, which makes it harder to monitor … Read more
Winlogbeat and Sysmon setup. Integration with ELK
This post is all about windows logging with winlogbeat and sysmon in place to collect all the important logs possible. Without getting into details about the installation of ELK stack I will get started with the installation of services and configuring the server to process that logs. Here is the link for installation script for … Read more
OSSEC auto key sync. Add the OSSEC agent automatically. Mass deploy OSSEC agent
As I wrote in my previous post about getting ossec logs on ELK stack, I included part to install ossec server. As to install OSSEC agent there is an same procedure that we performed during OSSEC server. To be honest I am feeling lazy to write it all again to here is a link for … Read more
Install MozDef on ubuntu
Opensource siem has its own place in the SOC world. Even commercial siem uses Opensource components like elasticsearch, kibana, and logstash. Some of the popular opensource SIEM include OSSIM, The ELK stack, OSSEC, Wazuh, Apache Metron and MozDef by Mozilla. The reason behind writing this post is to help with the installation process of MozDef. … Read more