It goes like this: 1. Create a fork 2. Modify the fork, add files, change content 3. Create pull request for the original repository
4/ If you have a link to a great tutorial or learning aid, please share it with others by replying to this tweet.
Would you be interested in short videos that describe how to use a basic tool like the Github desktop client to cooperate with some of our repos like Sigma?
Side note:
When you like Git and run Linux servers, you'll probably love etckeeper, a tool that keeps track of every change in your /etc directories by handling them as git commits
1/x A #COVID19#OffTopic thread for my followers in countries that still enjoy the quiet before the storm.
It is serious. Don't listen to the voices that play it down.
But also don't panic.
The problem with SARS-CoV-2 is that the treatment of severe cases (~5-10%) require ..
2/x .. intensive care beds with respirators.
Here in Germany, we have 29k intensive care beds, most of them occupied long before COVID19.
If only 1% of the citizens get sick, that would be 830k citizens, 83k of them with the severe clinical course of the disease.
3/x I guess you can imagine what that means.
Italy is about 10 days ahead of us.
Doctors in Italy decide every morning in a so called "triage" who gets a bed with lung ventilator and who doesn't, which is basically a death sentence.
These patients slowly suffocate.
Log Sources Top 5
(ordered by cost-benefit ratio / volume > detectable threats)
1. Antivirus 2. Windows Eventlog (+Sysmon) 3. Proxy 4. Firewall 5. DNS
1/ I‘ll give some short comments to help you understand the order
In general: I included only those logs that can already be collected in most organizations, when you start a SecMon project.
Bro/Zeek, Suricata, Netflow, etc. would be somewhere between 2 and 4 if available. ..
2/ Some logs are more difficult (cost/effort) to tap into.
e.g. Antivirus logs can often be collected from a single console, while NSM requires high speed network Taps on mirroring ports in central locations (💵). If you have the budget and time, NSM is worth the effort.