Documentation

Blumira Configuration

Blumira Getting Started Guide
Create a Blumira Sensor
Blumira Sensor Outbound Allowlist
Reinstalling or Updating a Blumira Sensor
Security Findings
Role-Based Administration
Dynamic Blocklists and Threat Feeds
Deploy a Blumira Honeypot
Build a Sensor on Ubuntu

Cloud Services

Azure AD Event Hubs
Cisco Umbrella
Duo Security
Google G Suite
Infoblox
Okta
Microsoft Defender for Endpoint
Microsoft Defender for Office 365
Microsoft Office 365
Microsoft Cloud App Security
LastPass

AWS

AWS: Getting Started Guide
AWS: Kinesis Data Stream and IAM
AWS: CloudWatch
AWS: GuardDuty
AWS: CloudTrail
AWS: VPC Flow Logs

Endpoint

Blackberry Cylance
CrowdStrike Falcon Endpoint Protection
ESET Endpoint Protection
Malwarebytes
Malwarebytes Nebula
Microsoft Defender for Endpoint
Sophos Central
Symantec Endpoint Security
Trend Micro Apex One
VMware Carbon Black Response
VMware Carbon Black Managed Defense
VMware Carbon Black Endpoint Protection

Microsoft Server

Advanced Microsoft Logging (GPO Template)
System Monitor (Sysmon)
Microsoft Windows Firewall
Microsoft Windows PowerShell
Microsoft Windows IIS
Microsoft Active Directory
Microsoft Windows Server

Microsoft Cloud

Azure AD Event Hubs
Microsoft Defender for Endpoint
Microsoft Defender for Office 365
Microsoft Office 365
Microsoft Cloud App Security
Microsoft Security Modules

Identity

Duo Security
Okta
Microsoft Active Directory
LastPass

Firewall

Check Point Next-Gen Firewall
Cisco ASA Firewall
Cisco FTD FirePower Threat Defense
Cisco Meraki Firewall
Citrix Netscaler ADC
F5 Big-IP
Fortinet Fortigate Firewall
Palo Alto Next-Gen Firewall
Palo Alto Networks Panorama
SonicWall Next-Gen Firewall
Sophos XG Firewall
WatchGuard Firebox Firewall

Other

Osquery
Apache Web Server
Apple Mac OS
Forescout
KnowBe4 – PhishER
Linux Auditd File Integrity Monitoring
Linux Journald
Linux Servers
Nginx Web Server
Proofpoint Advanced Threat Protection
VMware VSphere/VCenter
WinLogBeat Forwarding

Security Guides

How to Image Machines for Forensic Use
How to Disable Null Session in Windows
How to Disable LLMNR, Netbios, WPAD, & LM Hash
How to Configure SMB Signing

Detection Tests

Deletion of Windows Event Log Detection Test
PowerShell Execution Policy Bypass
Domain Administrator Account Creation
Password Spraying
How To Test a Honeypot
Office365 Inbox Rule Creation

Threat Feeds

Threat Feed: Abuse.ch SSL Blocklist
Threat Feed: Abuse.ch Feodo Tracker
Blumira Feeds: An Overview