PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Automated Graylog Open Setup using Puppet

projectblack.io | research | #siem | #automation | #logging | #graylog | #puppet | #windows-event-log
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A zero-cost SIEM deployment automated with Puppet: single-node Graylog Open with OpenSearch and MongoDB, ingesting Windows Event logs and creating a key security detection for Essential Eight needs.
Published
Collected

Related coverage

research · projectblack.io
Announcing Partnerships with Graylog and Tenable
Project Black announces partnerships with Graylog and Tenable to support ASD Essential Eight goals: Graylog for SIEM and log management, Tenable for vulnerability management across the attack surface.
research · blog.sentry.security
Log Curation 101
A SIEM log curation checklist: nine log source categories ranked by investigation value into tiers, guiding parser work, retention spending, and detection engineering.
blog · netspi.com
3 Lessons Learned from Simulating Attacks in the Cloud
Lessons from NetSPI's cloud attack simulations: default cloud logging alone is insufficient, SIEM rules need tuning, and breach and attack simulation (BAS) helps validate detective controls in Azure.
blog · semperis.com
AD Security 101: SIEM Tools and AD Monitoring
Why SIEMs alone can't secure AD monitoring: attackers bypass AD logs (DCShadow), and SIEMs face collection limits, configuration errors, processing gaps, stale threat intel, and false positives.
research · eshard.com
Thales automates their firmware security testing with eShard
Thales has licensed eShard’s esFirmware platform to test more thoroughly and with more flexibility their embedded firmware.
blog · bughunters.google.com
Fixing Debug Log Leakage with Safe Coding
Google explains how unaware logging of complex data structures can leak secrets such as cryptographic keys, and how safe-by-default APIs prevent debug log leakage by design.
Back