Tuesday, November 13, 2018

Your Boss Wants You to Get Certified—Find Out Why That’s a Good Thing

›
Recently I received a mail from Cisco with the text in the title of this blog post. Obviously I was curious, so I read it. The report focuse...
Saturday, November 10, 2018

Visualizing your Zeek (Bro) data with Splunk - x509.log (x509 Certificate logs)

›
Looking at x509 certificate information can be a good sign of the type of secure communication occuring in your environment. On most days yo...

Visualizing your Zeek (Bro) data with Splunk - dns.log (dns logs)

›
DNS logs are one of the most critical logs into what is going on in your environment. Like HTTP, there is a push towards encrypting DNS traf...

Visualizing your Zeek (Bro) data with Splunk - conn.log (connection logs)

›
To be able to visualize this data, we first need to understand it's structure. Zeek's (Bro's) data by default are in a tab deli...

Visualizing your Zeek (Bro) data with Splunk - http.log (http logs)

›
The HTTP logs be it from your web server or any other source should be an area where great focus is placed. We do a large number of communic...

Visualizing your Zeek (Bro) data with Splunk - The Setup

›
In the two ( 1 , 2 ) previous post which were done on Bro, we focused on installing Bro and configuring Bro . Since then, I've learnt...
Friday, November 2, 2018

Spoofing/Replaying IBM QRadar packets/flows - tcpreplay (the more interesting way)

›
This post is a continuation of this previous post . In the previous post, we looked at obtaining packets/flow data without the need for a...