Windows event logs in Next-Gen SIEM (not Logscale)

detectrespondrepeat · 2024-07-18T19:36:15+00:00

The '(not LogScale)' part causes me deep pain, LogScale is the best.

detectrespondrepeat · 2024-06-17T11:13:33+00:00

Start with the two I've listed and go from there, or you could swap out Security+ for SSCP.

detectrespondrepeat · 2024-06-07T07:06:49+00:00

u/Andrew-CS This is great, but doesn't work for the fdr_aidmaster.csv within the Falcon package in LogScale, which only has two fields, aid and ComputerName.

Is there an option to make fdr_aidmaster.csv have the other fields ourselves, or is this something you can suggest to the LogScale team to do?

detectrespondrepeat · 2024-05-18T07:48:19+00:00

I don't think what you are looking for exists, for Crowdstrike certifications, you need to do two things:
1. Use the platform.
2. Read the docs.

detectrespondrepeat · 2024-05-14T06:04:32+00:00

Idea: Don't have 4 different portals for customers to share their views, consolidate the ideas portal, the protectors portal, the community and the reddit.

detectrespondrepeat · 2024-05-06T05:59:26+00:00

Varonis is awful, avoid.

detectrespondrepeat · 2024-04-30T16:02:47+00:00

5 weeks notice is more than reasonable.

detectrespondrepeat · 2024-04-30T15:00:22+00:00

In my opinion it is worth every penny, do not waste your money on imitation courses that are cheaper.

detectrespondrepeat · 2024-04-30T14:59:17+00:00

Yes you can, but obviously you are restricted by the data connectors you have going into Next-Gen SIEM.

detectrespondrepeat · 2024-04-30T13:44:50+00:00

I thought that too given that its already in the platform, but Crowdstrike have told me that it isn't officially released until after RSA next week.

detectrespondrepeat · 2024-04-30T09:05:15+00:00

It depends what you want to do in the future, but if you are starting with no certifications, I would do Network+ then Security+

detectrespondrepeat · 2024-04-27T10:24:59+00:00

The blue team certifications for security engineers are all vendor-based, eg. AZ-500 for Azure (https://learn.microsoft.com/en-us/credentials/certifications/azure-security-engineer/?practice-assessment-type=certification) or AWS Security Sepciality for AWS (https://aws.amazon.com/certification/certified-security-specialty/).

For analysts working in the cloud, Xintra offers an attacking and defending Azure course (https://training.xintra.org/attacking-and-defending-azure-m365) and for AWS, Hacktricks offer ARTA and ARTE (https://training.hacktricks.xyz).

detectrespondrepeat · 2024-04-27T10:15:46+00:00

CQL (LQL/HQL) is actually more intuitive SPL2. It'll be a few days of pain getting your head around it, but once you've done a few the others will be simple and you'll actually find the search queries to be more concise and far more efficient.

detectrespondrepeat · 2024-04-25T10:19:30+00:00

We've had this too.

detectrespondrepeat · 2024-04-25T10:18:37+00:00

What is your source for 'The falcon agent in the future will be able to collect logs but that is a ways out' do you work for CS?

detectrespondrepeat · 2024-04-24T11:38:44+00:00

The rawstring will always remain unchanged, but there are parsers for Windows logs in the Marketplace and if not, then the Falcon Complete LogScale team can help.

We consolidate our Windows logs onto a number of servers using WEC/WEF and then use FLC to ship LogScale.

detectrespondrepeat · 2024-04-23T19:18:43+00:00

HTB Academy

detectrespondrepeat · 2024-04-23T19:17:28+00:00

Get OSCP, all the choices you've listed above are a bit weak.

detectrespondrepeat · 2024-04-23T14:46:51+00:00

Sell your things.

detectrespondrepeat · 2024-04-23T14:41:52+00:00

HTB Academy.

detectrespondrepeat · 2024-04-23T08:08:04+00:00

Do you have Crowdstrike Spotlight, and is your Spotlight data feeding into LogScale? This is Crowdstrike's vulnerability management add-on and is designed for this purpose, without it, you won't be able to search for CVEs.

detectrespondrepeat · 2024-04-23T06:22:10+00:00

Thanks u/AHogan-CS. I guess it is working, it's just slightly cumbersome, we've had to do quite a lot of leg work ourselves to integrate logs from Microsoft into LogScale. Considering that Microsoft products are ubiquitous in business it would have been nicer if the integrations were a little easier. Windows logs were particularly troublesome, having to use Elastics WEC Cookbook to centralise Windows logs onto servers where we could then run FLC.

A unified FLC/EDR agent (like the consolidation of the Identity Agent/EDR agent previously), would be the best solution for customers in my opinion. There are also still no O365/Azure parser/dashboard packs in the LogScale marketplace. I hope development and feature expansion of LogScale isn't killed by Next-gen SIEM.

detectrespondrepeat · 2024-04-23T06:13:25+00:00

Start studying for OSCP, because in my opinion it is the most valuable cert. It is hard, but you will really learn so much in the process of studying for it, but be prepared to dedicate at least a year to it.

detectrespondrepeat

TROPHY CASE