Jason McCord

Security analyst, software developer, #Splunk fan. Log everything. #WLS #DFIR

[Jason McCord @digirati82]

If you bought "RG Cosmic Flying Orb Toy" from woot recently, mine caught fire while charging. FYI.

[Jason McCord @digirati82]

New WLS release! Now with File Integrity Monitoring and File Tail options to support STIG requirements, more metadata, RELP support, and more! https://t.co/IdltvbRuGD

[Jason McCord @digirati82]

@techspence new 439

[Jason McCord @digirati82]

I'm gathering WBCL/TCG data, and this PCR appears on only some hosts. It contains Windows AIK information, which I'm familiar with. Does anyone know what PCR 4294967295/0xFFFFFFFF "decodes" to, or is it just extra info? I pull all data via API, but the raw log has the data too.

[Jason McCord @digirati82]

Well...it was delivered.

[Jason McCord @digirati82]

@UPS My package is now extremely late, and you've literally driven by my house with the package on your truck and failed to deliver the package for multiple days in a row. I know there was some weather, but this is a bit much.

[Jason McCord @digirati82]

@AmazonHelp @amazon @amazonhelp You have drivers lost and literally trekking across fields because they don't read the delivery instructions.

[Jason McCord @digirati82]

@amazon It'd be nice if your drivers followed the Additional Delivery Instructions...

[Jason McCord @digirati82]

@AmazonHelp AI sounding replies in the private message, and a generic response to my problem does not solve an issue that's been occurring for months.

[Jason McCord @digirati82]

@LGUSSupport You took my money for a dryer on Sep 7, sent me a broken one, shipped a replacement 3 weeks ago and you don't know where it is. Is this expected? Yes, I've called many times with no answer other than the delivery company hasn't received it.

[Jason McCord @digirati82]

@TheJackForge Thought this was @soren_iverson at first...

[Jason McCord @digirati82]

New WLS Release! Log forwarding from Windows to any SIEM. Add PE metadata to any logs with a file reference. Customize, filter, and format to meet your requirements. Route logs based on network location, fully cached. Many more logging features!
https://t.co/3yk9KSHbZU

[Rasta Mouse @_RastaMouse]

Ok, https://t.co/R5lneJTjkT is now live. A simple GitBook of code-generated P/Invoke signatures. Just C# for now, but I may add Rust and a few others in the future.

[Splunk @splunk]

#SplunkNews: We’re excited to announce that Splunk and Cisco have agreed to join forces to create one of the largest software companies globally and realize our shared vision to keep organizations worldwide secure and resilient. Read more: https://t.co/ShOk00zL7y

[Jason McCord @digirati82]

@_sysengineer I do this for holidays

[Jason McCord @digirati82]

Enhanced Windows logging via WLS - SIEM, format, protocol of your choice. Now with more PE fields, LNK parsing, file system minifilter and WBCL reporting, remote configuration from version control systems, and sysmon configuration management. https://t.co/N2zpZM7k9Z

[Jason McCord @digirati82]

FileData captures your defined metadata since the XML is used as a command line parameter, allowing verification by hash

[Jason McCord @digirati82]

Coming soon - WLS + #sysmon ! Use WLS rules to deploy configs based on host attributes, sign XML with certs for integrity, load from https, UNC, gitlab. Also LNK file parsing, PE directory fields, App Store sig checking ... https://t.co/UISxHirqsD

[Jason McCord @digirati82]

Output of loading the config is logged

[Jason McCord @digirati82]

Nobody:
Outlook: Reminder - Meeting (22 hours overdue)