homepage
Open menu
Talk with an expert

Isolating Suspicious Endpoints with OSSEC

  • Wednesday, 10 Feb 2021 6:30PM UTC (10 Feb 2021 18:30 UTC)
  • Speaker: Xavier Mertens

OSSEC is a great tool to collect logs from your endpoints and servers. But do you know it also provides extra features that may help in your day-to-day IR activities? In this presentation, I'll explain how you can implement a feature proposed by most endpoint protection tools but at a light cost. After a short introduction about OSSEC and requirements, I'll explain step by step the implementation and show you a demo.

Login to Register

Related Content

Blog
DFIR - Blog - The Analysis of User Data In VADs_340 x 340.jpg
Digital Forensics, Incident Response & Threat Hunting
The Analysis of User Data In VADs: Extraction of Precise Data in Notepad Memory And Hunting For Malware Behavior
Adversaries have exploited Notepad as part of their malicious strategies, even disguising activities by masquerading malicious processes as Notepad.
Person Placeholder Image
Abdelrhman Mohamed
read more
Blog
DFIR - Blog - SOF-ELK's Evolution- A Comprehensive Update for Enhanced Digital Forensics_340 x 340(1).jpg
Digital Forensics, Incident Response & Threat Hunting
SOF-ELK®'s Evolution: A Comprehensive Update for Enhanced Digital Forensics
SOF-ELK is a free, open source bootable VM preconfigured with a custom Elastic Stack implementation tailored to security and investigative workflows.
Phil Hagen
Phil Hagen
read more
Blog
OO - Blog - November 2024's Top Threats_340 x 340.jpg
Digital Forensics, Incident Response & Threat Hunting
SANS Threat Analysis Rundown in Review: Breaking Down November 2024’s Top Threats
There’s always plenty of news on cyber threats to discuss, and this month was no exception.
370x370_katie-nickels.jpg
Katie Nickels
read more