neonprimetime security , just trying to help

Detection Engineering stages of maturity, getting the most out of your SIEM, a story over time #detectionengineering #blueteam #siem The ...

 Malware IP lookup service #siem detection rule idea dns request in:  - canireachthe.net  - ipv4.icanhazip.com  - ip.anysrc.net  - edns.ip-a...

https://twitter.com/neonprimetime/status/1313222901236142080 Hey for all you #infosec friends stuck with #ibm #qradar just like me, just rem...

Thought I’d share a thread on how we use a form of #Agile Scrum to keep our #SIEM detection engineering and threat hunting organized. #bluet...

If interested, I wrote a simple python script and saved it on github that queries the QRadar SIEM API for Offenses Assigned to a specific u...

I thought I'd share how I got the QRadar API working. I downloaded the sample API python modules (RestApiClient.py, SampleUtilities.py,...

In your SIEM here's how to setup a custom Right-Click menu for IP Address 1.) Open ip_context_menu.xml with an editor like 'nano...

Is your SIEM slow? Perhaps this command will help.      [xxx@yyy support]# ./findExpensiveCustomRules.sh      NOTE: This is typically fo...

Reference Maps allow you to query based off key-value pairs. An example of this would be if you have certain UserIds that are only allowed ...