CorelightForSecOps

Recopilar registros del Sensor de Corelight Este documento describe cómo puede recopilar registros del Sensor de Corelight mediante la configuración del Sensor de Corelight y un forwarder de Chronicle. Este documento también enumera los tipos de registro admitidos y las versiones de Corelight...

DFIR-O365RC

Table of contents: 1. Module description 2. Installation and prerequisites 1. Using Docker 2. Manual Installation 3. Managing the DFIR-O365RC application 1. Creating the application 2. Updating the application 3. Removing the application 4. Permissions and license requirements 5. Functions includ...

grove

Grove es un marco de recopilación de registros de Software como Servicio SaaS, diseñado para admitir la recopilación de registros de servicios que no admiten de forma nativa la transmisión de registros. Grove permite a los equipos recopilar eventos relacionados con la seguridad de sus proveedores...

DShield-SIEM

DShield Sensor Log Collection with Elasticsearch Introducción Este es un fork y una actualización significativa de la publicación inicial en el sitio web de ISC Storm Center por Scott Jensen como un documento BACS y los scripts publicados en Github. https://github.com/fkadriver/Dshield-ELK...

Phant0m

Phant0m | Windows 事件日志杀手 Svchost 在所谓的共享服务进程中至关重要，多个服务可以共享一个进程以减少资源消耗。将多个服务分组到单个进程中可以节省计算资源，这一考虑对 NT 设计者来说尤其重要，因为创建 Windows 进程比其他操作系统（例如 Unix 系列）需要更多时间和内存。1 简而言之：在 Windows 操作系统中，svchost.exe 管理服务，服务实际上作为线程在 svchost.exe 下运行。Phant0m 针对事件日志服务，找到负责事件日志服务的进程，检测并终止负责事件日志服务的线程。因此，虽然事件日志服务在系统中看似仍在运行（因为...

HTSOC

HTSOC — Integrated SOC System for Event Monitoring, Detection, and Investigation HTSOC is a self-built Security Operations Center system in a lab environment. The system combines log collection, detection with Splunk, alert/case management with TheHive, Observable analysis with Cortex, IOC lookup...

EUVD-2026-53474

A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging...

PT-2026-60460

Name of the Vulnerable Software and Affected Versions ubuntu-pro-client affected versions not specified Description An insecure symlink following issue exists within the pro collect-logs command framework. The utility uses predictable temporary file paths or user-accessible log directories to...

CVE-2026-10847

A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process. Successful exploitatio...

EUVD-2026-36247

A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process. Successful exploitatio...

CVE-2026-10847 Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OS

A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process. Successful exploitatio...

CVE-2026-10847

CVE-2026-10847 is a local privilege escalation affecting Check Point Identity Agent Full for Windows OS. An authenticated local user may gain SYSTEM privileges by exploiting improper handling of executable resolution during log collection. The documented impact is elevated privileges on the affec...

CVE-2026-10847 Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OS

A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process. Successful exploitatio...

PT-2026-48661

Name of the Vulnerable Software and Affected Versions Check Point Identity Agent Full for Windows OS affected versions not specified Description A local privilege escalation issue exists where an authenticated local user can execute arbitrary code with SYSTEM privileges. This occurs due to improp...

NetSecBed: A Container-Native Testbed for Reproducible Cybersecurity Experimentation

Cybersecurity research increasingly depends on reproducible evidence, such as traffic traces, logs, and labeled datasets, yet most public datasets remain static and offer limited support for controlled re-execution and traceability, especially in heterogeneous multi-protocol environments. This...

How to Change Where Logs are Stored on the Veeam Appliances

Changing Log Location Will Break Automated Log Collection The automated log collection tools built into both the Veeam Backup & Replication Web UI of the Veeam Software Appliance and the "Create support bundle" function within the Host Management Console collect logs only from the default log...

The vulnerability of the software for centralized logging, analysis, and storage of logs by Graylog, related to deficiencies in authentication procedures, allows attackers to escalate their privileges.

The vulnerability of the Graylog log collection, analysis, and storage software lies in the deficiencies of the authentication process. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...

MiracleLinux 3 : sos-1.7-9.62.0.1.AXS3 (AXSA:2012-526:01)

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2012-526:01 advisory. Sos is a set of tools that gathers information about system hardware and configuration. The information can then be used for diagnostic purposes and debugging...

Release Information for Veeam Backup for Microsoft 365 8.2 and Cumulative Patches

More Recent Version Available Please find the latest version of Veeam Backup for Microsoft 365 here: Veeam Downloads - Latest Version Build Numbers and Versions of Veeam Backup for Microsoft 365 Requirements This release can be used to: update manually from a previous Veeam Backup for Microsoft 3...

How to Collect Logs from Veeam Appliance Installer

Purpose This article documents how to collect logs from the installer for the Software Appliances included with Veeam Backup & Replication 13 Veeam Software Appliance, Veeam Infrastructure Appliance, and Veeam Hardened Repository Appliance. This procedure may be required if an installation-relate...