If you plan to create your own Security Operation Center using open-source solutions, one of the best Threat Detection and Monitoring, threat hunting, enterprise security monitoring, and log management is Security Onion. In this guide I will show you how to manually install Security Onion, and how to add an…

Last week Oracle announced the General Availability of VTAP in OCI. Oracle now has a VTAP service in your VCNs - Oracle Cloud Infrastructure Release Notes Today, Oracle launches the Virtual Testing Access Point (VTAP) service in OCI. VTAP functionality, sometimes referred…docs.oracle.com Using OCI documentation I have mirrored the traffic from my fresh Honeypot instance to my previously created Security Onion Instance.

Logs are important because if they are properly configured , they can provide information that usually can be missed. For Windows Instances, beside the normal Events, Sysmon is my preferred solution to enrich the Windows logs, but this will be part of a different blog entry. One of the blogs…

On my previous blog entry, I have shown how to leverage AuditD data in OCI Logging service. Now I will use the OCI Logging Service search option to create some MITRE ATT&CK Searches that will be used by Cloud Guard Insight Rules. From this rule mapping and the Attack Rules…

Today, one of my colleagues asked me if I know this application from OCI Marketplace: Oracle Cloud Infrastructure Edit descriptioncloud.oracle.com Until today, I was using the manual steps, but it looks like that Oracle created a solution here too: Secure and monitor Oracle Identity Cloud Service You can leverage the new Logging Analytics Service with other Oracle Cloud Infrastructure (OCI) services to obtain…docs.oracle.com

If you haven’t enabled OCI Logging Analytics yet in your tenancy, then now it’s time to do it. You will have a 10GB log ingestion free of charge, that you can use for fast troubleshooting of the ingested logs. As always the first step is to create the proper policies…

In my previous blog entries, I have described how to install Sysmon and how to get the Windows Events directly to Logging Analytics using OCI Management Agent. Now you are able to get the main windows events channels in Logging Analytics. …

One of the main advantages of running Oracle Databases in OCI, besides the automation, performance and advance functions, is also that you get Data Safe free of charge. As a short resume, Oracle Data Safe is a unified control center for your Oracle databases which helps you understand the sensitivity…

This is a short guide on how to collect logs from an Oracle Linux Instance, by installing the OCI Management Agent. This works for any Red Hat compatible kernel running on OCI, On-Premise or any cloud provider. Prequisites for this can be seen here: Perform Prerequisites for Deploying Management Agents…