Search Results for "siem"

Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims to make reliable detections accessible to all at no cost. Sigma is an open-source tool for defining generic detection rules for security event logs, enabling security professionals to detect threats across platforms.

Python script to get the last 5 minutes of accepted traffic logs via the trendmicro email security API and send them to a syslog server Script Python para obtener los ultimos 5 minutos de logs de trafico aceptado por medio de la API de trendmicro email security y enviarlos a un servidor de syslog Crontab */5 * * * * /usr/local/bin/python3.9 /home/user/tmes-syslog_0.02.py 2>&1 > /home/user/errores.txt ------------ # API documentation # Getting Started with Trend Micro Email...

RedELK is a tracking and monitoring tool for Red Teams, providing insights into engagements and supporting real-time situational awareness for offensive operations.

MozDef aims to bring real-time incident response and investigation to the defensive toolkits of security operations groups in the same way that Metasploit, LAIR, and Armitage have revolutionized the capabilities of attackers. We use MozDef to ingest security events, alert us to security issues, investigate suspicious activities, handle security incidents, and visualize and categorize threat actors. The real-time capabilities allow our security personnel all over the world to work...

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides event collection, normalization and correlation. For more advanced functionality, AlienVault Unified Security Management (USM) builds on OSSIM with these additional capabilities: * Log management * Advanced threat detection with a continuously updated library of pre-built correlation rules * Actionable threat intelligence updates from AlienVault Labs Security Research Team * Rich analytics...

CIS Benchmark testing of Windows SIEM configuration. This is an application for testing the configuration of Windows Audit Policy settings against the CIS Benchmark recommended settings. Lots of organisations struggle with noisy Windows devices, especially if the SIEM vendor is charging by events volume. auditpolCIS points users in the direction of logging subcategories that can be disabled. We made an assessment of the security value of subcategories versus their noise volumes. Note...