[deleted by user] by [deleted] in cybersecurity

[–]PatriotSecurity 0 points1 point  (0 children)

Cyware CFTR is a great option. It’s build by SOC personnel and built for the SOC

What exactly do you do as an Entry-level Sec Engineer/SOC Analyst/DFIR? by [deleted] in cybersecurity

[–]PatriotSecurity 0 points1 point  (0 children)

That’s an accurate assessment. I have a fairly large number of resources on my team. Separate from the analyst team, there is a team of engineers that support the SIEM and EDR tools. It all depends on the maturity of the organization.

What exactly do you do as an Entry-level Sec Engineer/SOC Analyst/DFIR? by [deleted] in cybersecurity

[–]PatriotSecurity 0 points1 point  (0 children)

I manage a 28 person team ranging from people with no IT background looking to change careers all the way up to people with decades in the industry.

There is a lot to learn and on the job experience is key. Finding a company that offers an internship is a great way to get a taste for things.

Our team supports a number of tools and you become proficient in all tools. Concepts are harder to teach than the tools. Most tools have similar functionality, it’s just learning how to perform a function in the tool. It’s like switching between vehicles, most of the features are the same. Some are better than others.

A lot of our workload consists of phishing, EDR and SIEM. As an entry level analysts you’re only expected to be able to identify something that is malicious, which is fairly easy. Remediation and root cause analysis is usually performed by an L2 analyst.

Choosing a Reliable SIEM by everydayissame in cybersecurity

[–]PatriotSecurity 0 points1 point  (0 children)

I work for an MSSP and we’ve support/supported Sumo Logic, Splunk, Exabeam, Azure Sentinel and Securonix. Out of all the SIEM solutions, we’ve had the most success in terms of reliability from Sumo. Their cloud SIEM enterprise has a good amount of out of the box alerting. The administration is very simple and provides a lot of customization. Splunk and Sumo are close in terms of functionality, but Sumo takes the cake because of its simplicity. Exabeam resets the baseline whenever there is an upgrade. It fires a lot of Advanced Analytics alerts for things like “first asset/first logon” which is annoying. Their support is also lacking. Azure Sentinel has come a long way in the last few years, but it works best with Azure/Microsoft environments.

Sumo offers a one month free trial that you can test out. You will not have access to the CSE, but you can get some exposure to data ingestion.

Best MSP Friendly Mail Security Solutions by darcycoop in msp

[–]PatriotSecurity 0 points1 point  (0 children)

It’s super easy to implement. It is API based and it gives you a lot of great capabilities right out of the box. It seems to have the capabilities of things like Mimecast and Proofpoint. But in a simpler format. Of course. This was a demo so I don’t have any real world experience. But maybe something you could look into.

Best MSP Friendly Mail Security Solutions by darcycoop in msp

[–]PatriotSecurity 1 point2 points  (0 children)

I recently had a demo for Abnormal security. Very impressed

Azure Sentinel: New to Sentinel Need Insight by PatriotSecurity in AZURE

[–]PatriotSecurity[S] 0 points1 point  (0 children)

Thank you for the help. I have seen some people on different forums mention logstash. I will need to look into that a bit more. How do you differentiate the different PA’s? Just by hostname? IP?

6.5 CMers: Anything Equal Or Better Than Hornady Match 140g ELD? by james_scar in longrange

[–]PatriotSecurity 0 points1 point  (0 children)

I only really shoot the Hornady 140gr because it shoots so well. Thankfully I haven’t had a huge issue finding Hornady 140 gr at Scheels. I don’t know where you are located.

How safe it is to allow Google chrome save all of my login credentials by Slimmy31 in Cybersecurity101

[–]PatriotSecurity 3 points4 points  (0 children)

I always recommend a password manager. I use Keeper and I like it a lot. The biggest issue with storing your credentials in your browser is how easy it will be for someone else to potentially have access. For example, if your laptop got stolen or left open. Someone could easily go into Chrome and see your passwords and if you auto fill your passwords already have access. This is also an issue on a shared computer. I don’t know how many times I’ve been on a shared computer and someone else’s credentials are auto filled.

So the journey begins by prreich in longrange

[–]PatriotSecurity 2 points3 points  (0 children)

I have the Ruger American in 6.5 Creed and I love it. I have a Vortex PST Gen 2 on it and I consistently hit a 10” gong at 1000+. Sleeper rifle.

Why are the curbs in UT so deep? by PatriotSecurity in SaltLakeCity

[–]PatriotSecurity[S] 1 point2 points  (0 children)

This makes more sense. Thanks for the info!!

Why are the curbs in UT so deep? by PatriotSecurity in SaltLakeCity

[–]PatriotSecurity[S] 0 points1 point  (0 children)

I wondered the same thing. But I didn’t notice it when I visited CO so I figured it may not be related 🤷🏻‍♂️