ssi0202

logstash error while fetching metadata with id xxxx

5

fresh install on ubuntu the logstash log is full of this, and no data is getting ingested. I have just set up a winlogbeat to ship data from a client...

added IOC field in if actions are detected that fit ATT&CK mitre technique

2

initial compromise via browser (drive by) spearphising (office suite launches cmd powershell etc.) tested with embeded code in office documents to launch browser and cmd/powershell you will need to do...

hi the default alert rules in sentinel for Threat Intelligence uses the security event 4688 as a source, woudl it be possible to rewrite this rule so i can use...

match to windows defender ATP logs as well as sysmon

2

don't you guys talk to each other at MS security dev/teams/products or am I missing something here? ;-) awesome work!!! really appriciated!

run this in docker locally

4

not knowing alot about aws but is there anything in here that would make it impossible just to run this in docker