Building a Blue Team's Cloud Incident Response Forensics Knowledge Base Tool Using Open Source
In the process of incident response, the cybersecurity blue team often needs to conduct a large amount of analysis, including extensive log analysis for cloud events. This presentation mainly shares how to use open source tools for analysis. This includes the mention of SOF-ELK, the open-source forensics project by SANS utilizing Elasticsearch, the use of Graylog + OpenSearch for SIEM analysis, and ways to quickly analyze malicious logs by incorporating established Sigma Rules and other blue team knowledge.
TOPIC / TRACK
SecOps Forum
LOCATION
Taipei Nangang Exhibition Center, Hall 2
7F 701B
LEVEL
Advanced Advanced sessions explore cybersecurity topics, including architecture, tools, practical experiences, and strategy comparisons. Content often features code explanations, protocol analysis, reverse engineering, live demos, and is suitable for experienced cybersecurity professionals.
SESSION TYPE
Breakout Session
LANGUAGE
Chinese
SUBTOPIC
Cloud Security
SIEM
Blue Team
CYBERSEC 2024 uses cookies to provide you with the best user experience possible. By continuing to use this site, you agree to the terms in our Privacy Policy 。