In cybersecurity, there is a reality that every Delivery Manager faces daily: Defenders must succeed every single day, while attackers only need to succeed once. I recently had the opportunity to attend the SANS SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations course. It was an intense, high-value journey focused on optimizing…
Read MoreData exfiltration is rarely as obvious as a large file being copied to an attacker-controlled server. In many environments, sensitive information leaves through channels that look legitimate: a cloud storage service, a familiar application, an unusual destination country, or a removable device. This is where Elastic’s Data Exfiltration Detection (DED) package can help. Instead of…
Read MoreWhen the GLPI inventory plugin is used to collect agent inventories, assets may fail to appear in GLPI even though the agents reach the server. The cause was a bug in the Icinga Web 2 SSO plugin: GLPI 11 marks the inventory plugin’s endpoints as “stateless,” and the SSO plugin wrongly treated them like static…
Read MoreHistorical log data is valuable – until the cost of keeping every shard online starts competing with the value of the data itself. Elasticsearch searchable snapshots offer a practical middle ground for a NetEye installation: Keep an index in a snapshot repository, mount it when an investigation needs it, and query it through Elasticsearch or…
Read MoreWhy Dashboards Are Important In the modern IT world, simply collecting data isn’t enough: Real value comes when data can be quickly interpreted and transformed into useful information. Dashboards represent the final step of a process that starts with: Through charts, tables and interactive visualizations, dashboards allow users to: One of the main advantages of…
Read MorePostfix is not typically the first component that comes to mind when talking about critical services. And yet it’s through Postfix that all notifications, ticketing system-related correspondence, and monthly SLA reports are sent out from NetEye. As long as everything is working properly, Postfix is almost invisible. And that’s exactly what it does: silently and…
Read More1. Introduction The abuse of vulnerable drivers has become an increasingly common technique adopted by attackers to bypass modern security controls. This attack pattern, commonly referred to as Bring Your Own Vulnerable Driver (BYOVD), consists of loading legitimately signed but vulnerable drivers into the operating system in order to gain kernel-level privileges, disable security products,…
Read MoreHello to you all. It’s been a while. Don’t worry though, this won’t be a long and technical post. It’s just to let you know I’m doing (almost) well and to tell you about our latest news. The Metrics Challenge In the last year we’ve had a lot on our plate, but this hasn’t affected…
Read MoreHi everyone! Today I’d like to share with you an investigation we undertook related to ingesting Open Telemetry data in Elasticsearch, while maintaining tenant segregation from start to end. The Scenario Let’s imagine we have multiple customers, where in this case “multiple” may be well in the order of hundreds, who would like to send…
Read MoreRecently we had to monitor an EKS cluster and several other resources using NetEye. AWS already provides solid dashboards out of the box, but log analysis isn’t as flexible as in Elasticsearch, and costs can easily grow out of control. Our goals were to: AWS CloudWatch is a monitoring and observability service that collects logs,…
Read MoreIn this article I’d like to share my experience with Elastic certifications. Recently, I had the opportunity to take the Elastic Certified Engineer and Elastic Certified Observability Engineer exams and I’d like to describe my preparation, experience and finally share some useful tips for anyone else who wants to follow the same path. Overview of…
Read MoreA scalable approach to detecting malicious domains using Threat Intelligence and Indicator Match Rules One of the most common techniques used in phishing and initial access campaigns is the creation of domains that closely resemble legitimate ones. Attackers exploit typosquatting, homograph attacks, and brand impersonation to deceive users and steal credentials. For a Security Operations…
Read MoreIn many Elastic deployments, the natural approach every time you encounter a server with different needs is to create a new Fleet policy. Each group seems to require its own small set of tweaks or additional integrations. But the more policies you create, the harder it becomes to maintain and scale your configuration. In reality…
Read MoreFrom a Technical Consultant’s Perspective “How can I tell if a new Elastic Integration feature or PR is already included in my NetEye version?” Elastic adds new features quite often. However, these features do not always appear in NetEye right away. That’s because each integration requires a specific Kibana version. If NetEye doesn’t yet ship…
Read MoreIntroduction For on-premise Elasticsearch installations, performing a rolling restart across a cluster can be a time-consuming task, especially when dealing with large clusters. Rolling restarts are typically required when changing node configurations or upgrading the cluster to a new version. Elastic provides an official procedure to ensure service continuity during this process. However, after analyzing…
Read More