SwiftOnSecurityJan 5, 2023
One aspect of security configuration I don't see talked about enough is verbosity vs retention.
Do you really want this event of marginal use if it makes you have 20 fewer days before logs turnover?
Show threadAPT Ate My Homework
@SwiftOnSecurity or it makes all your searches run slower because something that's used in 0.01% of your analysis tasks is consuming over 50% of your data volume
Jan 5, 2023 at 4:20pmWeb
Show threadJason BraatzJan 5, 2023
@http_error_418 @SwiftOnSecurity it's this vs. getting yelled at by your director when the vendor says they can't figure out your outage because you didn't have the logging enabled
Show threadAPT Ate My HomeworkJan 5, 2023
@jasonbraatz @SwiftOnSecurity just because it's enabled at the source doesn't mean you have to collect and index it though...
Show threadConsoleWitchJan 5, 2023
@http_error_418 @SwiftOnSecurity APT, I love your user name.
Show threadAPT Ate My HomeworkJan 5, 2023
@ConsoleWitch @SwiftOnSecurity
why thank you 😊
Show threadConsoleWitchJan 5, 2023
@http_error_418 @SwiftOnSecurity wow, and I just realized that you're not a tea pot. Good to know.
Show threadAPT Ate My HomeworkJan 5, 2023
@ConsoleWitch @SwiftOnSecurity but I -am- a teapot. That's why I return an error when you ask for coffee
Show threadConsoleWitchJan 5, 2023
@http_error_418 @SwiftOnSecurity oh of course, my mistake. I haven't read the RFC lately.