Thread by @blueteamblog

SIEM info thread.

I have posts with rules, SIEM best practices, threat hunting - blueteamblog.com

Free SIEM rules -

• github.com/Azure/Azure-Se…
• github.com/Neo23x0/sigma/…
• github.com/elastic/detect…
• github.com/elastic/detect…
•my.socprime.com/tdm/ (partially free)

Understanding commonly used log formats :

Windows Security Event Logs – search Event ID here – ultimatewindowssecurity.com/securitylog/en……
Azure AD Audit logs – docs.microsoft.com/en-us/azure/ac…
Azure AD SignIn logs – docs.microsoft.com/en-us/azure/ac……
Linux Logs – plesk.com/blog/featured/……

1/2

DHCP Logs – serverbrain.org/network-planni……
DNS Logs – nxlog.co/whitepapers/dn……
Office365 – docs.microsoft.com/en-us/microsof……
Proxy Logs – vanimpe.eu/2016/10/21/pro…

2/2

There are plenty resources you can use to learn SIEM for free:

•cybrary.it/course/alienva…
•cybersecurity.att.com/resource-cente…
•siemonster.com/videos/
•splunk.com/en_us/training…
•youtube.com/channel/UCHrkR…
•securitylearningacademy.com/local/navigato…
•techcommunity.microsoft.com/t5/azure-senti…
•techcommunity.microsoft.com/t5/azure-senti…

Whoops forgot to include github.com/panther-labs/p…