Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: Diaries by Keyword Diaries by Keyword

Special Webcast: What you need to know about the crypt32.dll vulnerability. Register Now

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Date Author Title

FIREWALL LOGS NETFLOW

2010-03-10Rob VandenBrinkWhat's My Firewall Telling Me? (Part 4)

FIREWALL

2019-11-22/a>Xavier MertensAbusing Web Filters Misconfiguration for Reconnaissance
2019-03-05/a>Rob VandenBrinkPowershell, Active Directory and the Windows Host Firewall
2019-01-22/a>Xavier MertensDNS Firewalling with MISP
2018-12-19/a>Xavier MertensRestricting PowerShell Capabilities with NetSh
2018-09-22/a>Didier StevensSuspicious DNS Requests ... Issued by a Firewall
2017-08-23/a>Xavier MertensMalicious script dropping an executable signed by Avast?
2015-02-23/a>Richard PorterSubscribing to the DShield Top 20 on a Palo Alto Networks Firewall
2013-10-18/a>Rob VandenBrinkCSAM - Why am I seeing DNS Requests to IANA.ORG in my Firewall Logs?
2013-07-27/a>Scott FendleyDefending Against Web Server Denial of Service Attacks
2013-07-20/a>Manuel Humberto Santander PelaezDo you have rogue Internet gateways in your network? Check it with nmap
2013-04-25/a>Adam SwangerGuest Diary: Dylan Johnson - A week in the life of some Perimeter Firewalls
2013-03-13/a>Johannes UllrichIPv6 Focus Month: Kaspersky Firewall IPv6 Vulnerability
2013-03-08/a>Johannes UllrichIPv6 Focus Month: Filtering ICMPv6 at the Border
2013-03-05/a>Mark HofmanIPv6 Focus Month: Device Defaults
2012-05-17/a>Johannes UllrichDo Firewalls make sense?
2012-05-08/a>Bojan ZdrnjaWindows Firewall Bypass Vulnerability and NetBIOS NS
2011-07-15/a>Deborah HaleWhat's in a Firewall?
2010-11-08/a>Manuel Humberto Santander PelaezNetwork Security Perimeter: How to choose the correct firewall and IPS for your environment?
2010-06-14/a>Manuel Humberto Santander PelaezAnother way to get protection for application-level attacks
2010-03-10/a>Rob VandenBrinkWhat's My Firewall Telling Me? (Part 4)
2010-03-05/a>Kyle HaugsnessWhat is your firewall log telling you - responses
2010-03-03/a>Daniel WesemannWhat is your firewall log telling you - Part #2
2010-02-23/a>Mark HofmanWhat is your firewall telling you and what is TCP249?
2009-10-30/a>Rob VandenBrinkNew version of NIST 800-41, Firewalls and Firewall Policy Guidelines
2009-01-12/a>William SaluskyWeb Application Firewalls (WAF) - Have you deployed WAF technology?
2008-11-20/a>Jason LamLarge quantity SQL Injection mitigation

LOGS

2020-01-12/a>Guy BruneauELK Dashboard and Logstash parser for tcp-honeypot Logs
2019-12-07/a>Guy BruneauIntegrating Pi-hole Logs in ELK with Logstash
2019-09-17/a>Rob VandenBrinkInvestigating Gaps in your Windows Event Logs
2019-06-06/a>Xavier MertensKeep an Eye on Your WMI Logs
2019-05-19/a>Guy BruneauIs Metadata Only Approach, Good Enough for Network Traffic Analysis?
2018-07-17/a>Xavier MertensSearching for Geographically Improbable Login Attempts
2018-06-21/a>Xavier MertensAre Your Hunting Rules Still Working?
2017-07-09/a>Russ McReeAdversary hunting with SOF-ELK
2016-08-29/a>Russ McReeRecommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs
2016-06-01/a>Xavier MertensDocker Containers Logging
2014-08-15/a>Tom WebbAppLocker Event Logs with OSSEC 2.8
2014-02-14/a>Chris MohanScanning activity for /siemens/bootstrapping/JnlpBrowser/Development/
2014-02-09/a>Basil Alawi S.TaherMandiant Highlighter 2
2014-01-04/a>Tom WebbMonitoring Windows Networks Using Syslog (Part One)
2013-12-03/a>Rob VandenBrinkEven in the Quietest Moments ...
2013-10-10/a>Mark HofmanCSAM Some more unusual scans
2012-12-02/a>Guy BruneauCollecting Logs from Security Devices at Home
2012-07-13/a>Russ McRee2 for 1: SANSFIRE & MSRA presentations
2012-07-11/a>Rick WannerExcellent Security Education Resources
2012-05-02/a>Bojan ZdrnjaMonitoring VMWare logs
2012-04-08/a>Chris MohanBlog Log: More noise or a rich source of intelligence?
2011-11-19/a>Kevin ListonMonitoring your Log Monitoring Process
2011-06-21/a>Chris MohanAustralian government security audit report shows tough love to agencies
2011-06-20/a>Chris MohanLog files - are you reviewing yours?
2011-05-17/a>Johannes UllrichA Couple Days of Logs: Looking for the Russian Business Network
2010-12-24/a>Daniel WesemannA question of class
2010-04-06/a>Daniel WesemannApplication Logs
2010-03-10/a>Rob VandenBrinkWhat's My Firewall Telling Me? (Part 4)
2010-02-23/a>Mark HofmanWhat is your firewall telling you and what is TCP249?
2010-01-29/a>Johannes UllrichAnalyzing isc.sans.org weblogs, part 2, RFI attacks
2010-01-20/a>Johannes UllrichWeathering the Storm Part 1: An analysis of our SANS ISC weblogs http://appsecstreetfighter.com
2009-10-26/a>Johannes UllrichWeb honeypot Update
2009-01-09/a>Johannes UllrichSANS Log Management Survey
2008-08-19/a>Johannes UllrichA morning stroll through my web logs
2008-08-05/a>Daniel WesemannWatching those DNS logs
2006-09-18/a>Jim ClausingLog analysis follow up
2006-09-09/a>Jim ClausingLog Analysis tips?
2006-09-09/a>Jim ClausingA few preliminary log analysis thoughts

NETFLOW

2018-10-10/a>Xavier Mertens"OG" Tools Remain Valuable
2017-09-29/a>Lorna HutchesonGood Analysis = Understanding(tools + logs + normal)
2010-03-10/a>Rob VandenBrinkWhat's My Firewall Telling Me? (Part 4)
2006-10-03/a>Swa FrantzenDetecting attacks against servers