Tylium - Primary Data Pipelines For Intrusion Detection, Security Analytics And Threat Hunting

These files contain configuration for producing EDR endpoint detection and response data in addition to standard system logs. These configurations enable the production of these data streams using F/OSS free and / or open source tooling. The F/OSS tools consist of Auditd for Linux; Sysmon for...

SUSE SLED12 / SLES12 Security Update : audit (SUSE-SU-2019:1166-1)

This update for audit fixes the following issues : Audit on SUSE Linux Enterprise 12 SP3 was updated to 2.8.1 to bring new features and bugfixes. bsc1125535 FATE326346 Many features were added to auparsenormalize cli option added to auditd and audispd for setting config dir In auditd, restore the...

SUSE SLED12 / SLES12 Security Update : audit (SUSE-SU-2019:0563-1)

This update for audit fixes the following issues : Audit on SUSE Linux Enterprise 12 SP4 was updated to 2.8.1 to bring new features and bugfixes. bsc1125535 FATE326346 Many features were added to auparsenormalize cli option added to auditd and audispd for setting config dir In auditd, restore the...

Linux: Separate partition for /var/log/audit directory

The /var/log/audit directory is used by auditd. This script tests options set on /var/log/audit filesystem. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General...

Honeybits - A Simple Tool Designed To Enhance The Effectiveness Of Your Traps By Spreading Breadcrumbs & Honeytokens Across Your Systems

A simple tool designed to enhance the effectiveness of your traps by spreading breadcrumbs & honeytokens across your production servers and workstations to lure the attacker toward your honeypots. Author: Adel "0x4D31" Karimi. Background The problem with the traditional implementation of honeypot...

Extending Linux Executable Logging With The Integrity Measurement Architecture

Gaining insight into the files being executed on your system is a great first step towards improved visibility on your endpoints. Taking this a step further, centrally storing logs of file execution data so they can be used for detection and hunting provides an excellent opportunity to find evil ...

Extending Linux Executable Logging With The Integrity Measurement Architecture

Gaining insight into the files being executed on your system is a great first step towards improved visibility on your endpoints. Taking this a step further, centrally storing logs of file execution data so they can be used for detection and hunting provides an excellent opportunity to find evil ...

Extending Linux Executable Logging With The Integrity Measurement Architecture

Gaining insight into the files being executed on your system is a great first step towards improved visibility on your endpoints. Taking this a step further, centrally storing logs of file execution data so they can be used for detection and hunting provides an excellent opportunity to find evil ...

openSUSE Security Update : krb5 (openSUSE-2016-230)

This update for krb5 fixes the following issues : - CVE-2015-8629: Information leak authenticated attackers with permissions to modify the database bsc963968 - CVE-2015-8630: An authenticated attacker with permission to modify a principal entry may have caused kadmind to crash bsc963964 -...

SUSE SLED11 / SLES11 Security Update : krb5 (SUSE-SU-2016:0430-1)

This update for krb5 fixes the following issues : - CVE-2015-8629: Information leak authenticated attackers with permissions to modify the database bsc963968 - CVE-2015-8631: An authenticated attacker could have caused a memory leak in auditd by supplying a null principal name in request bsc96397...

openSUSE Security Update : krb5 (openSUSE-2016-181)

This update for krb5 fixes the following issues : - CVE-2015-8629: Information leak authenticated attackers with permissions to modify the database bsc963968 - CVE-2015-8630: An authenticated attacker with permission to modify a principal entry may have caused kadmind to crash bsc963964 -...

Systems Integrity Management Platform – SIMP

The System Integrity Management Platform SIMP is an Open Source framework designed around the concept that individuals and organizations should not need to repeat the work of automating the basic components of their operating system infrastructure. Expanding upon this philosophy, SIMP also aims t...