Fred Rohrer's Blog (Page 2)

Fred Rohrer's Blog

Sign in Subscribe

Selecting and Creating Detection Rules with Syslog and Splunk

In today's cybersecurity landscape, effective detection rules are crucial for identifying and mitigating potential threats. Syslog, a standard protocol for logging system events, can be leveraged to create powerful detection rules. By ingesting these rules into Splunk, a leading security information and event management (SIEM) platform, organizations can

Detection & Response - Introduction

What is Detection and Response? Detection and Response (not DR - Disaster Recovery) in cybersecurity refers to the basic processes and techniques used to detect and respond to cyber threats. Detection: * Monitoring: Continuous monitoring of network and device activity to identify abnormal behavior. * Log Management: Gathering and analyzing logs from

Detection & Response - Alert Deployment and Tuning

This post is about log monitoring basics, including log deployment and tuning.

Palo Alto XSOAR + GPT-3

In this post, I will be discussing how security automation can benefit from the advanced language understanding capabilities of GPT-3. By integrating GPT-3 into XSOAR, security teams can leverage the power of natural language processing to improve the efficiency and effectiveness of their incident response processes. I will be walking

Smarthome Auditing - Logging Kasa Devices to Splunk

Home automation is just the greatest thing ever, isn't it? Because who doesn't love the idea of being able to control their entire house with the swipe of a finger on a tiny screen? I mean, why bother actually getting up and flipping a light switch

Cybersecurity Program Basics

Starting to plan out a Cybersecurity program for your company can be a challenging task, but in many ways the steps to take have more benefits than just increased security. Introduction Cybersecurity programs are categorized into people, technology and process. People refer to the employees, contractors, and other individuals who

MITRE ATT&CK

What is the MITRE ATT&CK Framework and how did it come to be? Summary The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a comprehensive knowledge base of adversarial tactics and techniques based on real-world observations. It is designed to help organizations understand the

The STRIDE Methodology

The STRIDE methodology aims to help with the question "how can our system be exploited and what security paradigms can we use to secure it?" It extends the commonly used CIA Triad (Confidentiality, Integrity and Availability).

Why Cybersecurity is important for small business

Small business and non-profits often overlook the dangers of cyber-attacks to their organization but small business is just as likely to be hacked as big business, and the fallout of a breach could be more damaging.