Collaborate Disseminate
I am now read about TheHive Project – open source incident response platform.
Today i asked developers about automatization of incidents, and find, that TheHive can’t do this.
Main feature for me is automatization in the fol… Continue reading What use to automate incident response? [on hold]
Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc…
Security breaches, hacks, “cyber” attacks or server compromises happen quite frequently, unfortunately, such as Quora in December 2018, Facebook in September 2018, Equifax in September 2017, Exactis in June 2018, MyFitnessPal… Continue reading Incident response and recovery from a security breach with unknown attack vector
I’m studying common malware characteristics, and I’m having a bit of difficulty understanding the design choices the malware authors make. Many of said choices seem to revolve around making life difficult for a human analyst … Continue reading Malware Author’s Mindset
I’m wondering what kind of software Computer Security Emergency Response teams use to manage their work? For example to catalog incidents, responses and manage risks.
I’m setting up a small SOC & would like to know if there are any sources where I can get runbooks for common security incidents like an AV detection, phishing email received, failed login attempts for Azure AD, etc.
All … Continue reading Where can I find runbooks for common Security Incidents?
In the Computer and network security incident taxonomy what are the differences between “Incident”, “Attack” and “event”? Where does “threat” fit with them?
Continue reading What is the difference between "Incident", "Attack" and "event"?
I’m currently trying to find indicators of compromise in order to use them with Redline. I just can’t seem to find any other sources than:
https://www.iocbucket.com/
https://openiocdb.com/
https://github.com/sroberts/awesom… Continue reading Looking for a list of indicators of compromise [on hold]
Since a couple of days ago my Debian server started to get login attempts (see log file below). /var/log/auth.log goes only three days back, although the server has been running for much longer.
I noticed that the network in… Continue reading Debian server invalid loging attempts and high bandwidth use
I applied for a job
The test is
information security in general
How can I prepare? There exists many books, huge courses, etc.
Continue reading How can I prepare for the information security test for a job? [on hold]