Hot take: Getting rid of daylight savings time isn't enough, we should all move to UTC.
Remote
Vern McCandlish
@malanalysis@infosec.exchange
mastodon 4.8.0-alpha.3+glitchGeeky dad jokes related to dfir, malware, osint, infosec, iiot, incident response, law enforcement, empty nest, marriage, and gaming. (he/him)
1561 Followers
712 Following
2 Posts
Joined November 10, 2022
Important reminder for SIEM janitors to frequently check their SIEM for common password field structures to find occurrences where stuff that should not be getting logged to the SIEM is getting logged. I was reminded when I was telling a story about finding credentials and payment information in an applog that was also helpfully being indexed in the SIEM. I am recommending free form regex searches of the raw entry, not just looking for named fields. #SIEM #Cybersecurity #Incidentresponse