Clik here to view.
UK crime stats and ArcSight
Thinking of ArcSight as a holistic system for log collection and analysis I decided not to limit its usage to the usual OS, Network, DB and Application logs and try to include some relevant physical...
View ArticleClik here to view.
HP Onboard Administrator (HPOA) integration with ArcSight
IntroThe Onboard Administrator for the HP BladeSystem enclosure is the brains of the c-Class infrastructure.Together with the enclosure's HP Insight Display, the Onboard Administrator has been designed...
View ArticleClik here to view.
Identifying rogue connections – Part 1
Proxyrss.com provides a convenient way to retrieve the IP addresses of many known proxy servers.The complete list of known proxies is provided in a form of GZ archive which is free for download.In case...
View ArticleClik here to view.
Identifying rogue connections – Part 2
In Part 1, external proxy IP addresses were brought into ArcSight environment. The task was automated using Microsoft PowerShell and FileReader flex connector.In Part 2, configuration will be...
View ArticleClik here to view.
OSSEC Server GUI
This program is a small GUI wrapper for the most common tasks performed in OSSEC server CLI. Some people, who work with OSSEC as part of their daily job, may find it useful.Program is written in Java...
View ArticleClik here to view.
The case of OSSEC registry monitoring on x64 2008 R2 server
OSSEC (Open Source Security) solution for OS integrity monitoring is what we’ve been using for years. It’s free, robust and can help a lot with PCIDSS compliance checks.After migrating the datacentre...
View ArticleClik here to view.
Configuring log rotation for Citrix NSWL and ArcSight FC.
Hi, as you might have noticed already the previous CitrixWebLogs (NSWL) and ArcSight FC integration blog post did not cover the log rotation mechanism for the NetScaler WebLog text based file. You...
View ArticleClik here to view.
The case of a corrupted smart connector cache
SmartConnectors are using hard drive space to cache the events in a compressed format when there’s a spike in the volume of incoming events or when the destination is down. Cache settings can be...
View ArticleClik here to view.
OSSEC local config file sweep replacement
This time there was a need to brush up ossec.conf file on all OSSEC agents within the Active Directory domain. The reason behind it is the Centralized OSSEC Agent Configuration feature.Ideally, the...
View ArticleClik here to view.
The case of ArcSight Web "mixed status"
It all started with good intentions – upgrade ArcSight Express 3.0 to 4.0.The guide was short and concise although I was getting the impression of “underwater obstacles” ahead. Prerequisites were met...
View ArticleClik here to view.
Getting started with ArcSight ESM Web Api – Part 1, obtaining the AUTH key.
ArcSight ESM (as well as Express) offers a range of web based services. To get the list of the services available navigate to https://hostname:8443/www/manager-service/services/listServices URL, where...
View ArticleClik here to view.
Getting started with ArcSight ESM Web Api – Part 2, preparing content.
Last time I showed how to obtain the list of available ArcSight ESM web services by browsing this URL:https://hostname:8443/www/manager-service/services/listServices. This time I’ll focus on a specific...
View ArticleClik here to view.
Imperva DAM and SQL Cluster nuances
Imperva SecureSphere represents an important part of a “defence in depth strategy” for SMBs and big enterprises alongside with SIEM, IDS/IPS, DLP and other technologies aimed at data protection from...
View ArticleClik here to view.
Installing Apache Thrift
What is Apache Thrift?Scalable cross-platform, cross-language binary RPC code generation engine to allow developers to build cross-language services.Developed by FacebookOpen sourced in April...
View ArticleClik here to view.
Repairing ArcSight broken resources
Many thanks to Adil Muganlinsky for his kind help with the issue.______________________________________________Generally, it is quite simple to find and fix ArcSight broken resources, either by...
View ArticleClik here to view.
Enumerating Windows file shares using QualysGuard
Often, in a firewalled, network segregated environment, which is also additionally hardened, executing simple tasks like enumerating file shares, may turn into something more complex.This time, I show...
View ArticleClik here to view.
Clik here to view.
Spam Spam Spam... or Not?
Nowadays spam is smarter and targets specific groups of people. If you are security professional, you may receive crafted emails promising a “fresh report” or “security insights” if you follow the link...
View ArticleClik here to view.
The case of the unexpected Windows Server 2012 slowdown.
Recently I noticed that one of the VMs in my lab, which is Windows Server 2012 based became very sluggish after boot.This was a brand new VM with all updates installed and without any additional roles...
View ArticleClik here to view.
Azerbaijan certification authority hierarchy
Azerbaijan E-Imza (E-Signature) project was a very nice initiative few years ago and it is good to realize that I was part of the project at that time. The speed of adoption is something I was not...
View Article
