JJebitok6d ago · 7 min readThe Finance Trail - Splunk (TryHackMe)Link to the Finance Trail challenge on TryHackMe Case Briefing The numbers do not add up. You have been brought on at THM Security Services (TSS). Click the card below to reveal your role on this casesharonjebitok.com
JJebitok6d ago · 5 min readThe O365 Intrusion - Splunk (TryHackMe)Link to the O365 Intrusion on TryHackMe Active investigation High Situation Report Vantage Dynamics' IT team escalated a report from their Accounts Payable department on 27 August. An employee, Marcsharonjebitok.com
JJebitok6d ago · 3 min readBenign - Splunk (TryHackMe)Link to Benign challenge on TryHackMe Introduction We will investigate host-centric logs in this challenge room to find suspicious process execution. To learn more about Splunk and how to investigate sharonjebitok.com
RroutetorootSep 29 · 4 min readLab 24: The Attack Ran. The Alerts Fired.In Lab 13, I ran a brute force attack and got zero alerts. In Lab 24, I ran the same attack in Splunk. 15 alerts fired in under 2 seconds. That's the difference between a detection gap and a detection1blog.routetoroot.io
JJebitokSep 23 · 7 min readZero Tolerance (TryHackMe)Link to the challenge on TryHackMe: Zero Tolerance It was supposed to be a regular morning at ProbablyFine Ltd. L2 had just returned from paternity leave. L3 was hosting a live webinar on "Proactive 3Bsharonjebitok.com
JJebitokSep 23 · 16 min readPromotion Night: Splunk (TryHackMe)Link to the challenge on TryHackMe: Promotion Night It was a glorious Friday at ProbablyFine Ltd. After weeks of sales calls and PoC demos, the team finally signed a contract with DeceptiTech - a majsharonjebitok.com
RroutetorootSep 22 · 4 min readLab 23: Writing My First Splunk Detection RuleLab 22 got Splunk running. 180 events indexed. 76 SSH brute force events confirmed in the index. The pipeline was alive. But a SIEM with no detection rules is still just a search engine. Lab 23 is wheblog.routetoroot.io
JJebitokSep 22 · 2 min readSplunk: Exploring SPL (TryHackMe)Link to the challenge on TryHackMe: Splunk: Exploring SPL index=windowslogs index=windowslogs earliest="04/15/2022:08:05:00" latest="04/15/2022:08:06:00" | stats count index=windowslogs EventIsharonjebitok.com
RroutetorootSep 11 · 4 min readLab 22: Same Logs, New SIEM — Setting Up Splunk From ScratchLab 21 closed the detection gap in Elastic. 31 alerts fired. End-to-end detection confirmed. The Elastic SIEM phase of the portfolio was complete. So naturally, I installed a second SIEM. Lab 22 is thblog.routetoroot.io
JJebitokSep 9 · 2 min readResponse and Recovery (TryHackMe)Link to the challenge on TryHackMe: Response and Recovery Introduction Response and Recovery picks up where Detection and Analysis left off: the investigation into the compromised l.chen@nexusfinanciasharonjebitok.com
