With regard to enterprise security monitoring, many folks agree that it's best to be able to monitor from the top down, passively gathering network telemetry from a SPAN port or network TAP.

While there is ETW, Sysmon DNS and network connection logs, and more, how much of an impact has it been to not have more verbose network telemetry available during your investigations?

#DFIR
#IncidentResponse
#SecurityMonitoring
#SOC

I've updated the wlambert/velociraptor
@velocidex
#velociraptor Docker image to the latest release version.

https://github.com/weslambert/velociraptor-docker

This refers to the pre-built image.
If building locally, you'll always use the latest version.

Enjoy, and please let me know of any issues!

I have a contact looking for remote work:

- 3 years experience in/leading a #SOC
- Experience w/ multiple #EDR and log management/ #SIEM platforms
- Open to security/SOC analyst/ #GRC/Vuln mgmt roles

If you would like to chat or share an opportunity, please let me know!

#infosec
#infosecjobs

What do y'all think about a #C2 detection series including #SecurityOnion and #Velociraptor, illustrating the compliments and differences of host and network-based detection and response?

#BruteRatel
#CobaltStrike
#DFIR
#ESM
#Havoc
#Infosec
#NSM
#Sliver
#Sysmon