Lab 24: The Attack Ran. The Alerts Fired.
In Lab 13, I ran a brute force attack and got zero alerts. In Lab 24, I ran the same attack in Splunk. 15 alerts fired in under 2 seconds. That's the difference between a detection gap and a detection
#infosec
Posts tagged #infosec
Lab 23: Writing My First Splunk Detection Rule
Lab 22 got Splunk running. 180 events indexed. 76 SSH brute force events confirmed in the index. The pipeline was alive. But a SIEM with no detection rules is still just a search engine. Lab 23 is whe
Lab 22: Same Logs, New SIEM — Setting Up Splunk From Scratch
Lab 21 closed the detection gap in Elastic. 31 alerts fired. End-to-end detection confirmed. The Elastic SIEM phase of the portfolio was complete. So naturally, I installed a second SIEM. Lab 22 is th
Lab 21: I Finally Closed the Detection Gap
Eight labs ago, I ran a brute force attack against my own system and watched zero alerts fire. I knew the attack happened. The logs confirmed it. But the SIEM never saw it — because the logs that matt
Lab 13: The Attack Ran. The Alerts Didn't Fire.
In Lab 12, I built the detection rules. Three prebuilt Elastic rules targeting Linux attack techniques. One custom KQL rule for SSH authentication failures. The pipeline was configured, the rules were
Lab 12: How I Taught My SIEM to Recognize an Attack
Lab 11 got the pipeline running. Logs were flowing from my Kali Linux host into Elastic SIEM. The agent was enrolled. The data was real. But a SIEM that ingests logs and does nothing with them is just
