Corey Thuen

Co-founder at @gravwell_io. Embedded systems, SCADA security researcher. Acme Pharm CTFer. Plays well with others.

[Corey Thuen @CoreyThuen]

We didn't have an "explainer" video and run-of-the-mill animations are boring so we made this. I'd wager most of us got into this business because computers are fun and awesome. Keep the magic alive! https://t.co/ALT6vBeS6u

[Corey Thuen @CoreyThuen]

@_ProtocolPolice https://t.co/rd7nrXEz0D

[Corey Thuen @CoreyThuen]

@_ProtocolPolice @gravwell_io What you should really be complaining about is the default GUI login.

[Corey Thuen @CoreyThuen]

@_ProtocolPolice @gravwell_io Finally, a Gravwell indexer will not accept logs until a license is provided. While this doesn't really address the spirit of your concern, it is another brick in the wall of "a fresh Gravwell should not be dangerous".

[Corey Thuen @CoreyThuen]

@_Bajiri *brrcon

[Corey Thuen @CoreyThuen]

@_Bajiri Grrcon, Brecon, blueteamcon, and wild west hackin fest are the big ones kinda near MSP. Most have happened recently though.

[Robert Graham @robertgraham]

@sylv3on_ By learning how things worked first -- all the tedious boring bits rather than starting with the exciting stuff.

[Ma77Carpenter @Ma77Carpenter]

If you like hacking car ECUs, reverse-engineering software/firmware, tapping serial buses, fuzzing, or some combination of these things, DM me or email matt_at_grimm-co.com. Aerospace your thing? Medical devices? ICS and Power Grid? Endpoint-Dev? email me.

[Corey Thuen @CoreyThuen]

@reassuringURL @kwestin Shamless plug....since I helped build this, but you should check out https://t.co/A3Sxh2Zr12

We do NOT price on ingestion and we support white-labeling. If you can build on Splunk, you can build on Gravwell.

[Corey Thuen @CoreyThuen]

@sjhilt @kwestin @gravwell_io Appreciate the plug, but slight clarification is needed. While Gravwell is an awesome Splunk alternative, the core is closed source. We do have a lot of open source components and tools like our ingest framework (to prevent vendor lock in).

[Gravwell @gravwell_io]

Continuing to unpack #Gravwell "Orion" v5.0.0 is a new kit for Palo Alto Networks Next-Generation Firewall. You'll see traffic logs similar to Netflow but containing more metadata.

Read an in-depth overview and see the pre-built kit dashboards here: https://t.co/JdWLJWrkiV

[Corey Thuen @CoreyThuen]

So... our new flows feature adds automation capabilities to Gravwell, but it's *very* flexible. One of our devs was asked to write a basic "hello world" example but the jackass wrote a MIPS emulator to do it instead. Respect. https://t.co/xYgfdWgn7u

[Corey Thuen @CoreyThuen]

@strandjs "A system is good if it does what it's supposed to do, and secure if it doesn't do anything else." - Spaf

[Corey Thuen @CoreyThuen]

This is also why you should be streaming logs to a central repository.

[John Hubbard @SecHubb]

For anyone that's ever wondered "If I have EDR, is that enough? Do I still need separate network visibility?", below is one clear reason the answer is "yes". Endpoints are highly unreliable observers once compromised.

[Corey Thuen @CoreyThuen]

@0xKruzr @Theophite Haha. Not STO specifically, but "gravity well" yes. All data go in!

[Gravwell @gravwell_io]

Gravwell engineer John consistently gathered CPU temperature data from his machine and recently applied a BIOS update. Take a look at the clear-cut before-and-after results in this brief blog post (2-min read).

https://t.co/XMO4E5ZBZh

#Ryzen7 #AMD #CPUtemp #ASRock

[Corey Thuen @CoreyThuen]

Stats are cool! John is monitoring his CPU temperature and shows the before&after of a BIOS update. The chart of the average temperature didn't do much, but the variance is hilarious. https://t.co/gKvN4w0qZm