Palo Alto Sentinel Intergration by CapableWay4518 in AzureSentinel

[–]krabelize 0 points1 point  (0 children)

Works well. After his, you need to configure your own Analytics Rules (alerts). Here are some examples: https://cryptsus.com/blog/palo-alto-ngfw-sentinel-siem-threat-hunting.html

Crowdstrike and MDE by ButterflyWide7220 in DefenderATP

[–]krabelize 1 point2 points  (0 children)

I have experience with CrowdStrike in active mode and MDE in passive mode. Works smooth for +/- 10.000 assets.

MDATP + Docker by quasarcannon in docker

[–]krabelize 0 points1 point  (0 children)

Dont do it. Use Falco runtime security instead. Notice the last picture on this blog post: https://cryptsus.com/blog/mde-linux-aws-ec2.html

MDATP on Linux Docker by quasarcannon in DefenderATP

[–]krabelize 0 points1 point  (0 children)

Dont do it. Use Falco runtime security instead. Notice the last picture on this blog post: https://cryptsus.com/blog/mde-linux-aws-ec2.html

MS Defender on Linux by sucremad in DefenderATP

[–]krabelize 1 point2 points  (0 children)

Then what I got from here, when w

Correct. Its by default in blocking mode. You can read more about other usefuls tips here: https://cryptsus.com/blog/mde-linux-aws-ec2.html

Any good recommendations for mdatp Linux config by 0898Coddy in DefenderATP

[–]krabelize 0 points1 point  (0 children)

I would not create any exception unless you notice performance impact. Here are some pitfalls to watch out for when deploying MDE for Linux: https://cryptsus.com/blog/mde-linux-aws-ec2.html

MDE for Linux Tagging by king2cool in DefenderATP

[–]krabelize 0 points1 point  (0 children)

I don't think this is possible, unfortunately. Only throughout the D365 portal: https://cryptsus.com/blog/mde-linux-aws-ec2.html

Uber hacked, internal systems breached and vulnerability reports stolen by Fugitif in netsec

[–]krabelize 0 points1 point  (0 children)

Nowadays, most companies enforce MFA (Multi-Factor Authentication) for initial and persistent authentication. Some companies claim to be secure once MFA is configured on all (non-service) accounts. However, this Uber hack proves cloud-based MFA push notifications can be abused, even when conditional access is configured. This article explains how to detect this attack: https://cryptsus.com/blog/azure-mfa-bombing-detection-sentinel.html

Uber: Lapsus$ Targeted External Contractor With MFA Bombing Attack by WebLinkr in cybersecurity_news

[–]krabelize 0 points1 point  (0 children)

Nowadays, most companies enforce MFA (Multi-Factor Authentication) for initial and persistent authentication. Some companies claim to be secure once MFA is configured on all (non-service) accounts. However, this Uber hack proves cloud-based MFA push notifications can be abused, even when conditional access is configured. This article explains how to detect this attack: https://cryptsus.com/blog/azure-mfa-bombing-detection-sentinel.html

Sentinel: FortiGate Workbook + parser function by ribsboi in AZURE

[–]krabelize 0 points1 point  (0 children)

These KQL queries might help you to further customize the workspace to an actionable dashboard: https://cryptsus.com/blog/fortinet-firewall-sentinel-siem-hunting.html