Category Archives: OSSEC

[SANS ISC] Using OSSEC Active-Response as a DFIR Framework

Posted on by

I published the following diary on isc.sans.edu: “Using OSSEC Active-Response as a DFIR Framework”: In most of our networks, endpoints are often the weakest link because there are more difficult to control (example: laptops are travelling, used at home, etc).They can also be located in different locations even countries for

[The post [SANS ISC] Using OSSEC Active-Response as a DFIR Framework has been first published on /dev/random]

Continue reading [SANS ISC] Using OSSEC Active-Response as a DFIR Framework→

“Hunting with OSSEC” at BruCON Spring Training

Posted on by

My training submission has been accepted at the BruCON Spring Training session in April 2019. This training is intended for Blue Team members and system/security engineers who would like to take advantage of the OSSEC integration capabilities with other tools and increase the visibility of their infrastructure behaviour. OSSEC is sometimes described as

[The post “Hunting with OSSEC” at BruCON Spring Training has been first published on /dev/random]

Continue reading “Hunting with OSSEC” at BruCON Spring Training→

[SANS ISC] Hunting for Suspicious Processes with OSSEC

Posted on by

I published the following diary on isc.sans.edu: “Hunting for Suspicious Processes with OSSEC“: Here is a quick example of how OSSEC can be helpful to perform threat hunting. OSSEC  is a free security monitoring tool/log management platform which has many features related to detecting malicious activity on a live system like the

[The post [SANS ISC] Hunting for Suspicious Processes with OSSEC has been first published on /dev/random]

Continue reading [SANS ISC] Hunting for Suspicious Processes with OSSEC→

Training Announce: “Hunting with OSSEC”

Posted on by

I’m proud to have been selected to give a training at DeepSec (Vienna, Austria) in November: “Hunting with OSSEC“. This training is intended for Blue Team members and system/security engineers who would like to take advantage of the OSSEC integration capabilities with other tools and increase the visibility of their infrastructure behaviour.

[The post Training Announce: “Hunting with OSSEC” has been first published on /dev/random]

Continue reading Training Announce: “Hunting with OSSEC”→

Imap2TheHive: Support for Custom Observables

Posted on by

I’m using OSSEC to feed an instance of TheHive to investigate security incidents reported by OSSEC. To better categorize the alerts and merge similar events, I needed to add more observables. OSSEC alerts are delivered by email with interesting information for TheHive. This was an interesting use case to play

[The post Imap2TheHive: Support for Custom Observables has been first published on /dev/random]

Continue reading Imap2TheHive: Support for Custom Observables→