Results for “logs-ingestion”

Detect intrusion attempts, unauthorized access, and privilege escalation on Linux hosts using the auditd framework with ausearch and aureport utilities.

Analyze Linux system logs including auth.log, syslog, systemd journal, and auditd to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised systems.

Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.

Detects defense evasion techniques in endpoint logs, including log tampering, timestomping, process injection, and security tool disabling, using Sysmon, EDR telemetry, and SIEM queries.

Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs using pandas for behavioral analytics and statistical baselines.

Detects DNS-based data exfiltration, tunneling, and DGA communication by analyzing query logs with entropy analysis, volume anomalies, and subdomain length detection in SIEM platforms.