Insider Threat Series: From Blue Team’s perspective
Insider Threat is an overarching problem. Because there is no single tool could comprehensively cover Insider Threat. Insider Threat Detection needs building blocks of.
Leverage Purple Teaming To Assess Incident Response Capabilities
We get flooded with many different tools and technologies, whether open source or commercial, but one important question to ask ourselves is: “In the.
Effective Logging Series: 3 – Archive Splunk data to AWS S3 or Azure Blob Storage
https://github.com/tomwynn/coldToFrozenScripts/blob/master/coldToFrozenS3.py https://github.com/tomwynn/coldToFrozenScripts/blob/master/coldToFrozenBlob.py Data archiving is usually an afterthought. Most organizations only implement data archiving when compliance requires. But what if an incident happens and.