Cribl’s pipeline capabilities make it a powerful tool for processing and enriching logs. In this post, we’ll explore how to apply advanced modifications to Zeek logs in Cribl. Each modification needs to be placed in individual Eval function blocks within your pipeline to avoid errors and ensure smooth processing. In Read more
In the previous post, we discussed training the Transformer model, monitoring loss, and ensuring the model improves over time. Now, it’s time to take a step forward: evaluating the model’s performance and fine tuning it to make it more efficient and accurate. In this post, we’ll focus on: Evaluating the Read more
In the previous two posts, we built the basic and scalable versions of the Transformer model. Now, it’s time to move on to the next critical step of training the model. In this post, we’ll focus on: By the end of this post, you’ll have a Transformer model that can Read more
In the previous post, we learned about the basics of Transformer models and how they’re used to process language. Now, let’s go a bit deeper and look at how to build each important part of a Transformer. By the end of this post, we’ll have a full, working Transformer model Read more
In 2017, the AI landscape for language understanding changed dramatically when Google Brain researchers introduced a groundbreaking algorithm called the “Transformer” in their paper “Attention is All You Need.” Before this, AI models could only process one word at a time, often resulting in awkward, incomplete language. The Transformer’s self-attention Read more
Passkeys offer a passwordless and more secure way to authenticate to AWS accounts, reducing risks associated with credential-based attacks like phishing and password stuffing. Passkeys rely on cryptographic keys linked to users’ devices, making traditional passwords obsolete. This guide outlines the setup for passkeys in AWS IAM. What Are Passkeys? Read more
Identity and Access Management (IAM) is a critical cybersecurity frameworks which ensures that the right individuals and systems have appropriate access to an organization’s resources. In this post, I will break down IAM’s core concepts, explain its critical components, and provide technical examples of implementation. What is IAM? IAM refers Read more
Machine learning offers powerful tools for detecting anomalies in network traffic. This post includes technical details, sample logs, and Linux-based scripts to help you get started with anomaly detection using machine learning techniques. 1. Supervised Learning with Decision Trees Objective: Detect DDoS attacks by classifying normal vs. abnormal traffic using Read more
Safeguarding sensitive company information and ensuring compliance is essential in this day and age. Microsoft Purview offers a robust solution for unified data governance, protection, and compliance management across your organization. Step 1: Access Microsoft Purview Portal Step 2: Create a Microsoft Purview Account in Azure Step 3: Set Up Read more
Deploying applications on Kubernetes can initially seem complex. Using Helm, Kubernetes’ package manager, simplifies the deployment process by letting you define reusable configurations in a single chart. Here’s a breakdown of how Kubernetes and Helm work, and the practical steps we used to get this testing project up and running. Read more
Building a DevSecOps CI/CD Pipeline with Jenkins, SonarQube, and Snyk Using Terraform Introduction Incorporating security into Continuous Integration/Continuous Deployment (CI/CD) pipelines is a core DevSecOps practice. By leveraging tools like Jenkins, SonarQube, and Snyk, you can automate static and dependency vulnerability scans within your pipeline. This post will guide you Read more
Ansible simplifies IT automation by allowing you to configure, deploy, and manage infrastructure with straightforward YAML files. Here’s how we used Ansible to deploy Jenkins, SonarQube, and a sample application while automating repetitive tasks across our setup. We’ll also cover some powerful ways to extend Ansible’s capabilities. Table of Contents Read more
Overview For effective security management, you need visibility into your environment. SentinelOne offers powerful tools for auditing, reporting, and notifications that give you real-time insights, historical data, and alerts on critical events. Today, we’ll explore how to set up and customize these tools to maintain security oversight and ensure compliance. Read more
Overview Today, we’re exploring Advanced Detection Engines and Automation in SentinelOne. With advanced detection capabilities like Static and Behavioral AI, SentinelOne goes beyond traditional endpoint detection. Adding automation to these capabilities can help streamline responses and allow your team to focus on high-priority threats. Let’s break down how to configure Read more
Overview In this post, we’ll explore Incident Management and Threat Response workflows in SentinelOne. Here’s where the SentinelOne platform truly shines, offering a comprehensive toolset for managing incidents from detection through resolution. We’ll dive into the Incidents Tab, explain critical response actions, and touch on threat analysis tools like VirusTotal Read more
Overview In this post, we’ll focus on two critical components of SentinelOne: Sentinels and Policy Configuration. Sentinels manage your endpoints, allowing you to take actions like quarantine, remote shell access, and file retrieval. We’ll also cover setting up robust policies, including Detect and Protect modes, so your endpoints remain secure. Read more
Overview This is the first post of several in the S1 series. I wanted to write these in a way where you can get up to speed in S1 as quickly as possible. In today’s post, we’ll walk through the essentials of getting SentinelOne up and running, customizing the console Read more
Introduction: Have you ever wanted to test how a system reacts, displays information, or handles attacks by pushing a bunch of PCAP files through a router or an Intrusion Detection and Prevention System? In this blog post, we’ll show you an easy and free method to accomplish this. Step 1: Read more
All kinds of interesting information can be found using the Elasticsearch API. https://www.elastic.co/guide/en/elasticsearch/reference/current/search-search.html I find it easier than using Kibana, but Kibana was necessary to figure out the query language. Using the same queries, you can save out results and sort through them. The simplest example would be something like Read more