Incident response

Network traffic analysis for IR: Analyzing fileless malware

Introduction to fileless malware Fileless malware is malware authors’ response to traditional malware identification and analysis techniques. Many antivirus

Network traffic analysis for IR: Credential capture

Introduction to leaked credentials The concept of leaked or breached credentials is nothing new, with data breaches occurring on a daily basis. Most of thes

Network traffic analysis for IR: Content deobfuscation

Introduction to obfuscation Encoding and encryption techniques are used for a variety of purposes. Some of these are legitimate, like the use of encoding to

Traffic analysis for incident response (IR): How to use Wireshark for traffic analysis

Traffic analysis is the process of monitoring network protocols and the data that streams through them within a network. In this article, we’ll discuss how y

Network traffic analysis for IR: Threat intelligence collection and analysis

Introduction While any security professional can call themselves an analyst, the full scale and scope of the cyber-threat intelligence analyst is often unde

Network traffic analysis for incident response

Introduction Sophisticated cybercriminals understand the techniques and tools that they need to employ to move undetected throughout a victim network until

Creating your personal incident response plan

Introduction What should you do if your computer behaves abnormally? Is malware running behind the screen? Has your Personally Identifiable Information (PII)

Security Orchestration, Automation and Response (SOAR)

Gartner describes SOAR as the collection of disparate technologies that enable businesses to gather data and security alerts from different sources. The busi

Top six SIEM use cases

With rising trends and forms of attacks, most organizations today deploy a Security Incident and Event Management (SIEM) solution as a proactive measure for

Expert Tips on Incident Response Planning & Communication

An organization's ability to recover quickly in the wake of a cyberattack is directly proportional to their incident response capabilities. In essence, incid