In this post, I talk about hardening TheHive and Cortex for an Internet-accessible deployment. This includes the application of TLS v1.2+ and the configuration of multi-factor authentication. Cortex can be…
Building a Cuckoo Malware Analysis Server
I have written this guide a few times in the past, but here is a revised version with some notable inclusions based on more recent experiences with Cuckoo. I have…
TheHive 4.1.0 Deployment and Integration with MISP
Every few months, StrangeBee puts out an update to TheHive (Security Incident Response Platform). This month they have added Elasticsearch as an index engine to alleviate issues with using Cassandra,…
Building the Assemblyline Analyzer for TheHive’s Cortex.
Static analysis for me has become more fun with the inclusion of Assemblyline into my arsenal. But the lack of integration between other elements of my FOSS SOC stack was…
Building TheHive4 (4.0.5) and configuring MISP, Cortex and Webhooks.
Since the last write up I published on TheHive, there have been some significant changes and updates to TheHive. So for this post I will be walking through the installation…
Building a parallel-analysis Cuckoo server
Cuckoo's dynamic malware analysis platform is pretty good out of the box. But how can we scale it to allow parallel processing of samples, particuarly where Cuckoo is part of…
Cuckoo Dynamic Malware Analysis
Cuckoo is an automated dynamic malware analysis platform which allows for the analysis of submitted artefacts within a range of custom configured guest operating systems. Analysis environments may be created…
External Analysis with VirusTotal
VirusTotal is a subsidiary of Alphabet Inc. (which is also the parent company of Google). The service offers static and dynamic artefact analysis through a combination of free and paid…
Threat hunting with Elasticsearch and Kibana (Part 1)
As part of my final Masters degree research component I have been collecting data from honeypots which I have seeded around the globe. The objective being to distil this data…
Loading Windows Event Logs to Elasticsearch
So whilst playing through an element of Kringlecon 2019 I came across a task which didn't really suit my Christmas challenge of going to Linux full-time. One such challenge involved…