#detectionandresponse

0 message0 participant0 message aujourd’hui

Marco Ciappelli🎙️✨:verified: :donor:As you know — well, now you do 😬 — Marco Ciappelli and Sean Martin, CISSP, are now hosting webinars on ITSPmagazine!Yes, webinars are everywhere — but these are different: ITSPmagazine <a href="https://infosec.exchange/tags/Webinars" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Webinars</a> are More Than Just a Presentation. They’re Real Conversations That Matter.🎙️ Join us live on May 8 (or catch it On Demand) for an incredible conversation with Fred Wilmot. You already know it’s going to be an awesome one — don’t miss it! ✨Rethink, Don’t Just Optimize: A New Philosophy For Intelligent Detection And Response — An ITSPmagazine Webinar With DetecteamTraditional detection and response is overdue for a rethink. This webinar explores the limits of optimization, the danger of misleading metrics, and a new approach focused on adaptability, behavior-driven signals, and speed. See how Detecteam’s REFLEX Platform helps teams turn weak signals into fast, actionable detections—before attackers have time to move.REGISTER: <a href="https://www.crowdcast.io/c/rethink-dont-just-optimize-a-new-philosophy-for-intelligent-detection-and-response-an-itspmagazine-webinar-with-detecteam-314ca046e634" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.crowdcast.io/c/rethink-dont-just-optimize-a-new-philosophy-for-intelligent-detection-and-response-an-itspmagazine-webinar-with-detecteam-314ca046e634</a><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>, <a href="https://infosec.exchange/tags/detectionandresponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#detectionandresponse</a>, <a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatdetection</a>, <a href="https://infosec.exchange/tags/incidentresponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#incidentresponse</a>, <a href="https://infosec.exchange/tags/securityoperations" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#securityoperations</a>, <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>, <a href="https://infosec.exchange/tags/cyberdefense" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cyberdefense</a>, <a href="https://infosec.exchange/tags/securitystrategy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#securitystrategy</a>, <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a>, <a href="https://infosec.exchange/tags/detecteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#detecteam</a> <a href="https://infosec.exchange/tags/infosecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosecurity</a>

signalblur 📡🛸:verified:I recently wrote an article on <a href="https://infosec.exchange/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://infosec.exchange/tags/Ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ransomware</a> - I was surprised to see that more often than not, variants that have a “Linux” version are really targeting the hypervisor and encrypting the virtual memory.It’s an import distinction as your <a href="https://infosec.exchange/tags/EDR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EDR</a> / <a href="https://infosec.exchange/tags/Logging" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Logging</a> will not see a binary execute on the host VMs - you’ll want to ensure your <a href="https://infosec.exchange/tags/Hypervisor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hypervisor</a> <a href="https://infosec.exchange/tags/Logs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Logs</a> are being sent to your <a href="https://infosec.exchange/tags/SIEM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SIEM</a><a href="https://www.signalblur.io/through-the-looking-glass" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.signalblur.io/through-the-looking-glass</a><a href="https://infosec.exchange/tags/FOSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FOSS</a> <a href="https://infosec.exchange/tags/Unix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Unix</a> <a href="https://infosec.exchange/tags/Virtualization" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Virtualization</a> <a href="https://infosec.exchange/tags/Cloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cloud</a> <a href="https://infosec.exchange/tags/RHEL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RHEL</a> <a href="https://infosec.exchange/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> <a href="https://infosec.exchange/tags/OpenSuse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSuse</a> <a href="https://infosec.exchange/tags/CTI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CTI</a> <a href="https://infosec.exchange/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/Intel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Intel</a> <a href="https://infosec.exchange/tags/DetectionandResponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DetectionandResponse</a> <a href="https://infosec.exchange/tags/DetectionEngineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DetectionEngineering</a> (Re-posting as killing off all of the JavaScript on my site accidentally messed up the metadata when I share links 🙃 all fixed now)

Noah McDonaldFor those using GCP, do you have adequate coverage with your security detection rules? If not, here is a great resource that a teammate recently shared with me <a href="https://github.com/GoogleCloudPlatform/security-analytics" rel="nofollow noopener noreferrer" target="_blank">https://github.com/GoogleCloudPlatform/security-analytics</a>. This covers SQL, for both BigQuery and Log Analytics, and Yara rules. <a href="https://infosec.exchange/tags/gcp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gcp</a> <a href="https://infosec.exchange/tags/cloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cloud</a> <a href="https://infosec.exchange/tags/DetectionAndResponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DetectionAndResponse</a> <a href="https://infosec.exchange/tags/incidentresponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#incidentresponse</a> <a href="https://infosec.exchange/tags/threathunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threathunting</a>

woFFHere comes my late <a href="https://infosec.exchange/tags/introduction" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#introduction</a>... My first interaction with <a href="https://infosec.exchange/tags/appsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#appsec</a> was thanks to an integer overflow in railroad tycoon (the one from the 90s) allowing me as a kid to buy an infinite amount of buildings... Then few years later Softice came and I got absolutely amazed with all the things that's possible with a computer. Spent my evenings dialing into the internet and reading hacker forums... Fast forward a few years after building awful php apps next to university I ended up being a <a href="https://infosec.exchange/tags/pentester" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentester</a> / security consultant at a Big4. I really loved the pace and challenges but after some time felt that I'm missing to have some type of positive impact so switched sides. I spent the past almost 10 years at Prezi as a security engineer / engineering manager / something something / ... with a bit of back and forth between roles. I love working both with people (definitely felt more positive impact) and getting my hands dirty around anything security related be it <a href="https://infosec.exchange/tags/cloudsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cloudsecurity</a> <a href="https://infosec.exchange/tags/appsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#appsec</a> <a href="https://infosec.exchange/tags/infrastructuresecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infrastructuresecurity</a> or <a href="https://infosec.exchange/tags/DetectionAndResponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DetectionAndResponse</a> ... I still love to break stuff as I believe sometimes that's necessary before being able to rebuild it better.Since my son was born my priorities shifted finally and am focusing more efficiently on simply being a happy, decent human being instead of worrying about something all the time :) or at least that's what I like to think.I wasn't too active on twitter in the past years but looking at infosec.exchange brought up some good memories. Thanks <a href="https://infosec.exchange/@jerry" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jerry</a> for all the care that went and goes into it.

Recherches récentes

Options de recherche

Administré par :

Statistiques du serveur :

#DetectionAndResponse