Category: Uncategorized
-
The Simple Series: Python Tools for Blue Team Triage
Building detection tools before landing a security job is one way to close the experience gap. The Simple series came out of that approach. Three Python CLI tools, each solving a specific triage problem, each designed to be small enough to understand completely and useful enough to run against real data. Simple Phishing Analyzer Phishing…
-
Linux Security Monitoring with OpenSCAP and Splunk
A few months ago I started building out a home lab focused on detection engineering. This project covers Linux SIEM monitoring with Splunk and OpenSCAP on a hardened Ubuntu 24.04 VM with detections mapped to MITRE ATT&CK. The starting point is OpenSCAP, an open source tool that evaluates a system against a security benchmark and…
-
Suricata ET Noise
A couple weeks ago I installed an intrusion detection system, Suricata, on my home network to see if anything interesting showed up through Splunk. Now, my goal isn’t to monitor every single website that my family uses. Rather, see if the host devices are doing anything that they should not be doing. I started off…