As threats evolve it's important for organizations to keep pace. As part
of this trend many organizations are moving to Slack for team
communications and to help drive a more efficient operational workflow.
You can use the NetWitness Suite to help dr...
If you didn't catch Saket's update about Log Parsers, be sure to look at
all the improvements they made. Here's the January roll-up of the new
detection capabilities added via Live. ParsersPVIDCustomTCPLua Mail
Options filerekafCerberUpdates to the D...
Hopefully everybody had a great holiday season! I know we did, and we've
been getting some new capabilities into Live. For starters if you're
running 10.6.2, you'll notice 2 new bundles. The Starter Pack for Logs,
and the Starter Pack for Packets. Th...
The FirstWatch team is constantly tracking various threats and threat
actors. As part of their diligence they monitor 3rd parties for various
bulletins and reports. US-Cert recently issued a report detailing an
intrusion into a political organization...
For anybody wondering the reason the 'http not good mozilla' fires is
because the 'Mozilla' string is preceded by a double-quote ("). This is
non-standard for most/all modern browsers.
Guy, great question. I'll do a weekly roll-up on weeks where we've
released a lot, and monthly roll-ups of detection content that has
changed. Saket does monthly roll-ups of content as well. These will get
covered in the monthly, but I'll see if ther...
