log-add-http-post-bodies

POST-Body-Auszug zum HTTP-Log hinzufügen Dieses Skript gibt Analysten die Möglichkeit, einen Blick darauf zu werfen, was in HTTP-POST-Bodies gesendet wird. Es erreicht dies, indem es einfach das HTTP-Log erweitert. Installation :: zkg refresh zkg install corelight/log-add-http-post-bodies...

physical-analyzer-scripts

physical-analyzer-scripts Cellebrite Physical Analyzer python Skripte, um Analysten mit erweiterter Funktionalität zu unterstützen...

soc-analyst-hub

🛡️ Hub per Analisti SOC — Toolkit Tier 1 Un toolkit interattivo gratuito, completamente offline per analisti SOC Tier 1 — che copre risposta agli incidenti, triage degli alert, threat hunting e onboarding degli analisti. Zero dipendenze. Singolo file HTML. Apri in qualsiasi browser. 🚀 Demo dal viv...

stoq

Per iniziare Documentazione Installazione Repository dei plugin Documentazione dei plugin Panoramica stoQ è un framework di automazione che aiuta a semplificare i compiti noiosi e ripetitivi che un analista deve svolgere. Consente agli analisti e ai team DevSecOps di passare rapidamente tra diver...

awesome-soc-analyst

awesome-soc-analyst Abbiamo appena raccolto risorse utili per analisti SOC e candidati analisti SOC. Questo repository è mantenuto da LetsDefend. Sentiti libero di aggiungere nuove risorse qui. Indice Libri Analisi Malware Laboratori Pratici Analisi Phishing Strumenti per Indagini Fonti di Log di...

Manati

ManaTI-Projekt Machine Learning für intuitive Bedrohungsanalyse Das Ziel des ManaTI-Projekts ist es, Techniken des maschinellen Lernens zu entwickeln, um einem intuitiven Bedrohungsanalysten zu helfen, die Entdeckung neuer Sicherheitsprobleme zu beschleunigen. Das maschinelle Lernen wird zur...

SOC-Analyst-Portfolio

🛡️ Allen Ace Analista SOC | Threat Hunter | Ingegnere delle Detection Rileva • Investiga • Rispondi • Difendi Benvenuti Questo portfolio documenta il mio percorso pratico nella cybersecurity attraverso investigazioni reali, ambienti lab aziendali, detection engineering, digital forensics e securit...

EUVD-2026-62953

In Splunk Enterprise Security versions below 8.6.1, a user who holds the essanalyst Splunk Enterprise Security role could change User and Entity Behavior Analytics UEBA search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system...

EUVD-2026-62952

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

CVE-2026-76387

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

CVE-2026-76387

In Splunk Enterprise Security versions below 8.6.1, the Analyst Queue search filter handling does not validate filter field names before inclusion in SPL searches. A user with the mc_investigation_read capability can inject SPL, gaining access to all data and system integrity available to their s...

CVE-2026-76387 SPL Injection through the REST API in Splunk Enterprise Security

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

PT-2026-78814

Name of the Vulnerable Software and Affected Versions Splunk Enterprise Security versions prior to 8.6.1 Description A user with a role containing the mc investigation read capability can perform Search Processing Language SPL injection via Analyst Queue search filters. This occurs because the...

CVE-2026-64954

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

CVE-2026-64954 Velociraptor collect_client() Permissions Bypass

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

CVE-2026-64954 Velociraptor collect_client() Permissions Bypass

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

PT-2026-70995

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description Velociraptor allows scheduling new collections via VQL queries in notebooks. While scheduling a new collection typically requires the COLLECT CLIENT permission, this requirement is not...

EUVD-2026-54184

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

CVE-2026-71446

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

CVE-2026-56424

MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing on write paths. In affected subsystems, a lower-privileged authenticated user with the relevant feature permission could...