Bhavin Patel

[New Blog 📚] The Fragile Balance: Assumptions, Tuning, and Telemetry Limits In Detection Engineering If you ever struggle with false positives and the idea of tuning detections. This is for you. Read More - nasbench.medium.com/the-frag…

🚀 Happy to share my latest blog on @splunk: "Unlocking Endpoint Network Security Insights with Cisco Network Visibility Module (NVM) and Splunk" 🔗 Check it out here - splunk.com/en_us/blog/securi… In this post, I walk through how Cisco Network Visibility Module (NVM) works, the type of telemetry it generates and how to bring endpoint network telemetry to Splunk via the CESA TA. You can think of Cisco NVM as a Sysmon Event ID 3 on steroids, adding an insane amount of context to flow packets (child and parent process info, http method, loaded modules, etc.), It also provides process hierarchy logs allowing us to build process trees from processes that generate network traffic, as well as Osquery data on installed browser extensions, interfaces and OS information We leveraged this telemetry to build 14 new detections that surface suspicious activity directly from the endpoint’s network layer as well as mapped 16 previously written CIM detections to NVM data. 🔍Check out the "Cisco Network Visibility Module Analytics" Analytic Story here - research.splunk.com/stories/… Huge thanks to the Cisco NVM team for the help to bring this project to life. If you're using Cisco and Splunk, this is a great way to get more value from both. #Cisco #Splunk #NVM #ThreatDetection

Introducing 🚀Eventlog Compendium 🚀 A new Streamlit app, that aims to be the go-to resource for understanding and playing with Windows Event Logs. Explore it 👉 eventlog-compendium.streamli… Includes the following utilities and docs ⚙️ Build your own Advanced Audit Policy based on different data points making your policy data driven. 🧭EventID to Audit Policy mapping as well MITRE ATT&CK to Event ID explorer 📊Leveraging the EVTX-ETW-Resources project, you can explore the different ETW providers by build, version and filter down on key message strings. 📄 EVTX Baseline Search & Match - Explore the evtx-baseline project in a visual way. Where you can paste logs and check if they match in real time 🧮Event Field Decoder - Decode common Windows Security Event fields such as Logon Types, Access Masks, Active Directory GUIDs and SIDs 🔒Built-in SACL Explorer - leveraging SACL Scanner from Alexander DeMine, you can explore the built-in SACLs on a windows system. And much more to come. Stay tuned