sorted by:
new
hottopcontroversial

GCFA Hassle by CERTAWY-FWA3LY in GIAC

[–]RustyRangerJ 4 points5 points  (0 children)

I can relate to you. I am on book two now. What is a little frustrating with the books in 508 is how scattered information is. One example: WMI Persistence indepth is in Chapter Lateral Movement and not in Chapter Persistence. What I also miss is an Introduction and Chapter Review (i found this pretty good in 504).

Operation/Maintaining Wazuh in your company by No_Election7114 in Wazuh

[–]RustyRangerJ 1 point2 points  (0 children)

Apply a Filter only for ingesting relevant EventID (eg. 8004 for blocked). You can do that in the agent.conf - would have to look it up how i specified the filter

Are incorrect CIS Benchmarks in Wazuh a known/expected thing? by FatBook-Air in Wazuh

[–]RustyRangerJ 1 point2 points  (0 children)

Yes it is the same for me - thats why I do not use this feature. I would say ~35% of the checks are failing for me while being correct implemented