#detectionrules — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #detectionrules, aggregated by home.social.
-
Should a password spray detection in a SIEM alert you when there are 300+ failed logins against a collection of a dozen and a half accounts in an hour, or ONLY when one of those accounts subsequently logs in _successfully_ ?
Is it only a password spray if it eventually succeeds?
-
Should a password spray detection in a SIEM alert you when there are 300+ failed logins against a collection of a dozen and a half accounts in an hour, or ONLY when one of those accounts subsequently logs in _successfully_ ?
Is it only a password spray if it eventually succeeds?
-
A collection of threat detection rules / rules engines: https://github.com/jatrost/awesome-detection-rules
#DetectionRules #yara #sigma #falco #snort #suricata #splunk #kql
-
In the early 2000s, #SvenHenkel and myself developed an #IDMEF/ #IDXP compliant security event message pipelining framework for collecting and consolidating log messages, e.g., from network #IDS, and #EDR products.
In the messages stream, we were able to match multi-stage #correlation #DetectionRules in near real-time (in-memory), before everything was stored in a central database. Structural graph-based #AnomalyDetection was developed later by some colleagues.
We called it #MetaIDS.
-
In the early 2000s, #SvenHenkel and myself developed an #IDMEF/ #IDXP compliant security event message pipelining framework for collecting and consolidating log messages, e.g., from network #IDS, and #EDR products.
In the messages stream, we were able to match multi-stage #correlation #DetectionRules in near real-time (in-memory), before everything was stored in a central database. Structural graph-based #AnomalyDetection was developed later by some colleagues.
We called it #MetaIDS.