Exploring Windows Event Logs and Elastic Security for Incident Response

Tue, 31 Jan 2023 22:12:00 +0000

Elastic Security is incredibly useful for threat hunting especially with the success of tools like RockNSM and the HELK project. But what about hunting through old logs aided by detection tools that threat hunters use? How feasible is it to use Elastic Security if just want to stand it up the tool and throw some data at it? In this blog we we will explore how to take advantage of Elastic Security and the open source detection rules that are bundled in each release.

Setting up WSL, Ansible, and Packer for DevOps

Fri, 31 Dec 2021 22:48:24 -0600

WSL stands for Windows Subsystem for Linux. It allows Windows to run a lightweight Linux environment for running Linux binaries on Windows. I have not set it up from scratch by myself but have used it in the past with lab VM's like the one associated with Black Hills Information Security's Pay What You Can courses. However, over the holidays I got myself an upgraded laptop and so I thought I would give it a try!

Home on wriotsec

Exploring Windows Event Logs and Elastic Security for Incident Response

Setting up WSL, Ansible, and Packer for DevOps