SIEM Rule Creation Made Easy! Praeco/Elastalert and SIGMA

Подписаться 19 тыс.

Просмотров 11 тыс.

50% 1

Join me as we incorporate SIGMA and Praeco to add more detection and alerting to your SIEM stack!
Blog Post: / part-12-sigma-rules-fo...
🚩 CTF Challenge: ctf.socfortres...
📩 Contact Me: taylor.walton@socfortress.co
ℹ️ LinkedIn: / socfortressmdr
🧾 Our Blog: / socfortress
☕ Buy Me A Coffee: bit.ly/3woh21M
🚀 Security Operations Center as a Service: www.socfortres...
✅ Free For Life Tier: www.socfortres...
👨🏻‍💻 Professional Services: www.socfortres...
👾 Discord Channel: / discord
Series Playlist: • World's Best SIEM Stack

Опубликовано:

2 окт 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 9

@sg0luc Месяц назад

Howdy! First of all, congrats for this wonderful content. I have a question: is it possible to run only the praeco instance, assuming that I already use ElastAlert? Thank you so much!

@SomerRabee 4 месяца назад

Awesome video Could you please share with us another awesome video on how to to make Praeco v1.8.19 (latest) perfectly work with Opensearch 2.8, and if not please provide us with an idea or suggestion. Thanks a lot.

@xinghe3780 Год назад

How to integrate sigma rules into wazuh bro. this video don't show us how to

@aminehadjamar689 Год назад

Hi Taylor, Thank you for your wonderful content. I've been following this series since the beginning, but it seems to me that there are a lot of products that need to be linked together, especially since they are open source, which makes controlling them a bit difficult. I prefer to rely on WAZUH with the addition of one or two products just to compensate for WAZUH's deficiencies

@muneebalamkhan5036 Год назад

Hey!! i was going thru one of your video "Identifying Malware with VirusTotal and Wazuh - Let's Deploy a Host Intrusion Detection System #6" just want to tell you the my virus total integrations are generating alerts in /var/ossec/logs/integratoin.log but the same alerts are not being showed in wazuh manager (dashboard ). Please note I have already configured my agent ossec.conf syscheck block like this C:\Users\abc\Desktop no please help me resolve this issue. thanks !!