Bamm Visscher

Mossy Oak wearing incident handler and F8 monkey who loves his daughter.

[Bamm Visscher @bammv]

@thatboringbro We walked up hill in the snow carrying dual 20" Trinitron monitors while using it! And we liked it that way!

[Bamm Visscher @bammv]

@CloudSecPodcast Enjoyed this episode. For the record, I've also responded to thousands of incidents over the years (decades!) and many of them were first detected via IDS. There was a point where the vast majority of them fell into that category. #idsisnotdead :)

[Bamm Visscher @bammv]

I vowed to never post my Wordle results to social media. Morsle > Wordle

I copied today's Morsle at 35 WPM! https://t.co/oaRVTl1Rb3

[Bamm Visscher @bammv]

@SecShoggoth I use to own the openanalysis net/org domains with the idea of having a public NSM server others could escalate alerts/pcap to for help in analysis. After 10 years of doing nothing with them, I let them expire. tl;dr No.

[Bamm Visscher @bammv]

@chrissanders88 IIRC, Mcafee uses DNS to send/receive file reputation data.

[Bamm Visscher @bammv]

@7061756c0d I thought Tcl replaced it.

[Jason Lynch @jayl0w]

Do yourself a favor and instrument your network with sensors and pay for ET pro. NSM is far from dead. @securityonion + @ET_Labs goes a long, long way.

[Bamm Visscher @bammv]

@pmelson This! IMHO, a mature Incident Response process includes a prioritization matrix that escalates based on increased risk/impact to the business. Also, some of the replies to the orig post appear to be more about Incident Recovery (the LAST component in the larger response process).

[Bamm Visscher @bammv]

@taosecurity @Suricata_IDS Love Suri. Hoping for packet indexing some day.

[Bamm Visscher @bammv]

@SecShoggoth @WriterACMcHugh @charleypfaff Never heard of it. You?

[Bamm Visscher @bammv]

@DFIR_Janitor Report is escalation to the response process. An indication of compromise has been investigated/analyzed and confirmed it meets incident thresholds. In other words, someone pushed the F1/F2 button, not F8 ;)

[Bamm Visscher @bammv]

@taosecurity @EdwardTufte @sguilproject I once changed the default top and bottom padding for the text cells to mimick the more whitespace is visually pleasing trend. @jackcr caught me outside in a dark alley and beat me until I promised to change it back. True story.

[Jack Crook @jackcr]

We (GE-CIRT) are looking for a mid tier person to fill a *remote* role on our hunt team. This is a fantastic opportunity as I/we will teach you how to find bad guys, you just need to bring your other skills. #ThreatHunting #DFIR https://t.co/TsStvFOBCT

[David J. Bianco @DavidJBianco]

JUST ANNOUNCED: the FREE @sansforensics "New To Cyber" Summit!

A full day of tutorials and advice geared specifically for those looking for their first security job, career switchers, and those in their early careers and wondering where to go next.

https://t.co/XVh7rqpY2P

[Bamm Visscher @bammv]

@taosecurity @campuscodi I am not alone…. ;)

[Bamm Visscher @bammv]

Ordered ammo & $30 item from @opticsplanet. In stock ammo now backordered & both put on hold until Dec. I cancelled the ammo & tried to cancel the second item bc shipping went from FREE to $7.50. Sales cancelled it then charged/shipped anyway. Now want $8 to RMA. I want my $7.50!

[Bamm Visscher @bammv]

@taosecurity @FireEye @sguilproject Too cool! Always happy to see others finding it valuable.

[Bamm Visscher @bammv]

@taosecurity @sguilproject Good times!

[Bamm Visscher @bammv]

@Trex421 @charleypfaff @JosephFeather @TimothyHeilman4 It has been great working with you! While I am sad to see you go, I can't help but be happy to see you take advantage of a new/exciting opportunity. Always remember, life is better with `screen`.