Heck you know what?
-
Heck you know what?
I might pay money for detection rules for any of these open source tools: https://tech.lgbt/@risottobias/113685569855149875
Like, I would have a locked down environment in prod that only runs a small number of expected applications. Could tighten the expected behavior to just that.
Who does that kind of work?
#cybersecurity #securityhardening #detectionengineering #opensource
-
pizza in 10 daysreplied to pizza in 10 days last edited by
What's it called when you want to write a hardened set of expected behaviors for processes running in prod and then alert on anything else?
Like if I wrote a rule that says the expected binaries on the system are XYZ, the services are ABC, and I baseline those every update on a testing box before releasing updates and the new signature? (So, allowlisted behavioral detection, basically, similar to app armor profile design but for yara or selinux or whatever a good tool is?)
Are there articles on the subject or is there a word for it?
-
@risottobias like you would want someone to develop a set of detections for a particular environment or you would want to buy detections from someone to tune to that environment?
-
@funes allowlisting a particular environments behaviors probably. Otherwise the other two
