Mariano Zelaya

Solutions Engineer | (I)IoT | Cybersecurity | Advanced Analytics | Industry 4.0 | Digital Transformation

[Elastic @elastic]

Elasticsearch is the only 3rd party grounding source on Vertex AI today #GoogleCloudNEXT
* Answer with private data — see the difference for "how to patch a drywall"
* Keyword, semantic & hybrid search
* Search templates to personalize
* Via Vertex API / SDK or UI
– PK (@xeraa)

[elhacker.NET @elhackernet]

Implementar un Centro de Operaciones de Seguridad (SOC) utilizando Kali Linux en AWS

OPNsense Firewall
Kali Linux Purple
Cyberchef
Elasticsearch SIEM
GVM vulnerability scanner
TheHive incident response
Malcolm
Suricata IDS
Zeek IDS
https://t.co/0FRoWzYgKo

[Nicolas Krassas @Dinosn]

CVE-2024-53247: Splunk Secure Gateway App Vulnerability Allows Remote Code Execution https://t.co/myDzK8OIfQ

[Andoni Moreno-Mapamundi de Santurtzi @AndoniMoreno3]

EL MUNDO ES MAS DURO CUANDO NO ESTA DISEÑADO PARA TODO EL MUNDO

[Mariano Zelaya @zelayam]

@moritzkremb copycoder

[Elastic @elastic]

Elastic ❤️s @opentelemetry! Amazing to see Elastic and several of our Elasticians featured on the #OpenTelemetry Top Contributors 2024 board here at #KubeCon + #CloudNativeCon! - JC (@CastillaCodes)

[Hackmanac @H4ckmanac]

🚨Data Breach Alert - IBM

The threat actor "888" claims to have accessed 17,500 rows of data belonging to IBM in October 2024.

The compromised data, managed by a third-party provider, includes sensitive information of current and former IBM employees, specifically first names, full names, mobile numbers, and country codes.

[Elastic @elastic]

Next up in our Elastic Snackable Series 🎬 @xeraa is discussing Playground. Find out its importance and how you can use it to explore the future of search in the full video here: https://t.co/n1FaPIdk7X

#GenerativeAI

[SecurityWeek @SecurityWeek]

Post-CrowdStrike Fallout: Microsoft Redesigning EDR Vendor Access to Windows Kernel - https://t.co/B6N8ZJlUD2

[Elastic @elastic]

Elastic accelerates logs onboarding with Automatic Import powered by Search AI. Migrate legacy logs to AI-driven log analytics in record time by automating custom data integrations. Get the details here: https://t.co/tQkwlGSpyF

[Elastic @elastic]

Faster detection. Real-time insights. Unparalleled efficiencies.

Join our upcoming webinar on Sept 12 with @Azure to see how #SRE teams are supercharging #observability by integrating LLMs and AI assistants into their workflows. Get the details → https://t.co/bLr1VZBzPw

[The Register @TheRegister]

Warren Buffett’s favorite insurer, GEICO, drops VMware for OpenStack https://t.co/6GLaO5HLY4

[Pau Gasol @paugasol]

Happy birthday brother. I miss you dearly and I’m always thinking of you. ❤️#MambaForever

[The Debian Project @debian]

Debian Celebrates 31 years! https://t.co/wI0OBD4b0E

[Thorsten E. @endi24]

CrowdStrike broke Debian and Rocky Linux months ago, but no one noticed - Neowin https://t.co/Y2IWrX11hP

[mRr3b00t @UK_Daniel_Card]

I use @Microsoft Defender for Endpoint!

so I'm ok ;) mwahahahahahaha

[Kaspersky @kaspersky]

You wouldn't see this with any of our products (just sayin.) 🤷

[Nasreddine Bencherchali @nas_bench]

A good read by @ateixei that you should check out https://t.co/57bt2jnxAp

Just wanted to add a small take and perhaps expand on an idea that was highlighted in the article.

Before even reading, the answer should be obvious. EDR and Sysmon share only 2 basic things in common, which are they're both on the endpoint and they both generate telemetry. That's where the comparison ends.

If you're looking for both Detection and Response (the rest of the acronym) and 20 other features including managing deployments, alerts, incidents, etc. The answer was never ambiguous - GET AN EDR, ALWAYS.

So why do people even argue this (sometimes?). Its because not all EDRs are equal in telemetry.

Sysmon is simply a telemetry generation tool, one could even argue the security auditing that we enable with group policy is also another telemetry "tool" (that is even harder to manage). But some "mature" teams do it anyway. Why?

The answer is "custom use cases". Your uses cases will never be "all" covered by EDR built-in detections that's why custom detection exists. But, what if you want to detect something so crucial but no telemetry is provided by your EDR. You turn around to extra telemetry tooling (aka sysmon, security auditing or other shenanigans).

Is it worth it? You be the judge, but it does have its merit.

[Luke Jennings @jukelennings]

11/ If you want to know more about ghost logins, check out the SaaS attacks matrix entry for them – https://t.co/YV2CzWGj3t

[Vallée d'Aure 65 @Aure65]

Raymond #Poulidor trône désormais sur la montée du Pla d’Adet après une célébration empreinte d’émotion #cyclisme #mémoire #Pyrénées https://t.co/A1uxfja2p4