Building a Security Operations Centre (SOC) using open-source software is a cost-effective and scalable technique to secure your organisation. Open-source solutions provide strong capabilities, flexibility, and active community support, making them excellent for managing detection, response, and threat intelligence workflows. Here’s a quick overview of several effective open-source tools you …
What is yara rules: It is a tool used to identify patterns within files, often for detecting potentially malicious content. How to install: sudo apt install yara -y How to write: Create a file named my_first_rule.yar (or any other preferred name with a .yar extension) and enter the following text. …
Incident response plays a pivotal role in the cybersecurity landscape. First, automated, and efficient incident handling is critical to mitigating the impact of potential breaches, safeguarding organizations from escalating threats. In this blog post, I’ll demonstrate how to leverage Wazuh’s Active Response capabilities to fortify your security posture. The …
Vulnerabilities are innate security flaws in computer systems that can be exploited by hostile actors to break into and breach these systems. When these vulnerabilities are effectively exploited, malware and bad actors can enter the system and carry out nefarious tasks including data exfiltration, remote code execution etc. Thus, in …
In my preceding blog entry, available at this link, I provided a tutorial on the installation of WAZUH SIEM within a Dockerized environment. In this subsequent post, I will elucidate the procedure for deploying and configuring a WAZUH agent on an endpoint system to facilitate log forwarding. Prerequisites Before you …
WAZUH is an open-source security monitoring solution that helps organizations detect and respond to cyber threats. It provides a centralized view of your security posture, allowing you to monitor and secure your infrastructure, applications, and networks in real-time. It includes a variety of features and capabilities such as: Intrusion …
SPAM (or more specifically phishing) email is the most popular and effective weapon of cyber attack now a day. What is the first thing people do after receiving a spam email? Some got caught in the spammer net, some ignore it, some deletes the email, but as a security enthusiast …
The Uncomplicated Firewall (ufw) is a front end for iptables and is a host based firewall. In this tutorial we will see how to enable and configure ufw firewall on Ubuntu system. Ubuntu 8.04 LTS introduced ufw, and it is available by default in all Ubuntu installations after 8.04 LTS. One …
iptables, The most common and widely used Linux firewall for IPv4 traffic. Like iptables, Linux has another firewall utility called ip6tables which is used for IPv6 traffic. These two tables need to configure separately for IPv4 and IPv6 packet. In this tutorial we will see how to configure ip6tables in Ubuntu …
The goal of the Information security is Confidentiality, Integrity and Availability are also known as CIA triad. The security people who are protecting, and the bad people who are breaking the security are actually trying to protect and break these three things. The best and easy example is a DDOS …
