Automating Detection Coverage Analysis with ATT&CK Navigator
Staying on-top of the latest adversarial methodologies means quickly adjusting to new TTPs and...
Automating Detection Coverage Analysis with ATT&CK Navigator
Integrating Graylog With TheHive
If you couldn't tell by now, we love Graylog. We may have mentioned them a time or two :)
Network Defense Range (NDR) Returning to BlackHat 2020
We're thrilled to be accepted back to BlackHat to run our live-fire Network Defense Range (NDR)...
Graylog and Cylance Protect Integration
TL;DR - we needed to ingest multiple sources of Cylance logs into Graylog, and this is how we did...
Brokering Other Cloud Resources Behind AWS Services
I tweeted this the other day, and had a lot of folks reach out asking for more details/a diagram of...
The Infrastructure, II
After DEF CON last year, we posted this blog about our infrastructure, which was spread between a...
OpenSOC @ DC27 - Black Badge Edition!
We never wrote up a blog post for DC27, but this excerpt from the closing ceremonies covers most of...
Automating Graylog Pipelines
Part of our job at Recon relies on fine tuning our threat signatures that make up the bulk of our...
Analysis of Exploitation: CVE-2019-3396
The Recon incident response team recently worked an intrusion case involving a Confluence web...
Locking down ZeroTier peer-to-peer networks
In a previous post, we shared our affinity for ZeroTier: