Sunday, August 10, 2014

Beginning Memory Forensics - Mandant's Redline - Memory Analysis

›
In the previous posts, we setup the collector and acquired the memory image. In this post we will analyze our .mans file. Once we double c...

Beginning Memory Forensics - Mandant's Redline - Acquire the contents of RAM

›
In the previous post we dealt with setting up our collector. In this post we will acquire the memory contents of our suspect system for anal...

Beginning Memory Forensics - Mandant's Redline - Setting up the collector

›
A while back I did a 2 part post on beginning memory forensics with dumpit and volatility. For whatever strange reason, those seems to be my...
Sunday, August 3, 2014

Cyber Conflict vs Cyber War

›
Currently doing some reading and came across the topic Cyber Conflict vs Cyber Warfare which I thought was interesting. In investigating th...
Friday, August 1, 2014

QRadar - Extracting fields from WebSense events

›
As mentioned in my previous posts, no matter which tool you use for SIEM, there will be times when this information is not readily available...
10 comments:

QRadar - Extracting fields from Sourcefire events

›
As mentioned in the previous 2 posts in this series, we don't always get the fields parsed and displayed as we would like from the SIEM....

QRadar - Extracting fields from Imperva's SecureSphere events

›
As mentioned in my previous post, no matter which tool you use for SIEM, there will be times when this information is not readily available....
2 comments:

QRadar - Extracting Fields from FireEye events

›
One thing I've learnt that I know will remain true. No matter which tool you use for SIEM, there will be times when this information is ...