Auditd, KQL, Microsoft Sentinel

Doing tour of my simple detection lab #3 (Adversary Emulation)

Doing tour of my simple detection lab #2 (Sysmon)

Doing tour of my simple detection lab

Auditd shenanigans

Auditd Sigma Rules

Let's configure auditd log pipeline for my THS presentation

NSM with Suricata on Raspberry PI pt. 3

NSM with Suricata on Raspberry PI pt. 2

NSM with Suricata on Raspberry PI

Linux Detecting Keylogging with auditd

SOC, Linux, Detection Engineering, chillin

More SIGMA, practicing detection engineering

Linux Process Creation Monitoring

Detection Engineering

Blue Team

Linux CVE-2021-4034, auditd and kql

Writing Rules and Stuff

Auditd, KQL, Microsoft Sentinel

One format to Rule them all! Sigma, Linux

One format to Rule them all! Sigma, Linux, Capabilities

One format to Rule them all! Sigma!

More SIGMA Rulezzzz!

SIGMA Rulezzzz!

Developing KQL rules