Many SIEM installations use sysinternals sysmon as one of many data sources. Mark Russinovich (Microsoft Azure CTO, co-creator of sysinternals) released a video explaining some of the new features of Sysmon 11, which was released on 28th April.
A new useful feature is archiving a file, just before it is deleted. Some attackers delete their tools after gathering information. In order to understand their tools or even search for MD5 or imphashes, the sysmon 11 archiving function can be helpful.
(Source: https://www.youtube.com/watch?v=_MUP4tgdM7s)
Splunk finding "searches which did not run"
The value of Cisco's Splunk lies in the output of its searches: Either a search alert triggers something, a search reports something or ...
-
You can either use the GUI of the FortiGate to list all certificates, or use the CLI. Either using the commands: Using the "get...
-
The FortiGate uses OFTP (Fortinets proprietary Optimized Fabric Transfer Protocol, not Odette File Transfer Protocol ) to transfer data betw... -
FortiGate HA-Cluster Troubleshooting using Checksums Comparing checksums of cluster units You can use the diagnose sys ha checksum show ...
No comments:
Post a Comment