The Daily Shaarli

All links of one day in a single page.

September 24, 2019

SIEM integration with Office 365 Advanced Threat Protection | Microsoft Docs
If your organization is using a security incident and event management (SIEM) server, you can integrate Office 365 Advanced Threat Protection with your SIEM server. SIEM integration enables you to view information, such as malware or phish detected by Office 365 Advanced Protection, in your SIEM server reports. To set up SIEM integration, you use the Office 365 Activity Management API.

Downloads | Syslog Watcher
Syslog Watcher installs a dedicated syslog server, integrating log data from multiple network devices into a single, easily manageable and accessible place. Collecting and analyzing syslogs is essential for maintaining network stability and auditing network security.
Event Processing Pipeline
General overview of the Event Pipeline and Processes
QRadar: How to determine average event payload and record size (in bytes) (Updated)
I am curious as to what is the average size or my events for disk space estimates. Is there a method to determine this in QRadar?
IPv4Info - Tools
Features:

- ipv4 allocation table
- some registration data of all assigned and allocated blocks
- AS information and announced own prefixes
- geolocation data for ipv4 addresses
- all domains for ip address

Limitations:

- 500 requests from registered users within 24 hours.
- 200 requests from one ip address within 24 hours for unregistered users.

Data sources:

- registered blocks: regional registers: RIPE NCC, ARIN, APNIC, LACNIC, AFRINIC
- BGP table: Route Views Project
- Geolocation data: NetLoad, MAXMIND, IpGeoBase.ru, local additions. This site or product includes IP2Location LITE data available from http://lite.ip2location.com.
- Icons: Fugue Icons
- Flags: flags.blogpotato.de and Maxmind
- Social icons: komodomedia
Home - QRadar 101
Visit some of our other Support 101 Pages created specifically to assist customers in answering questions and reach a faster resolution to QRadar topics. We continually work to add more content to deliver value to our customers. These topics can be accessed from any of the QRadar 101 pages top menu bar.

CERT NetSA Security Suite
The Network Situational Awareness (NetSA) group at CERT has developed and maintains a suite of open source tools for monitoring large-scale networks using flow data. These tools have grown out of the work of the AirCERT project, the SiLK project and the effort to integrate this work into a unified, standards-compliant flow collection and analysis platform.

If you are new to the NetSA Security Suite, start with this overview of the components that comprise the NetSA Security Suite and their inter-operation.

CERT is a part of the Software Engineering Institute (SEI), a federally funded research and development center (FFRDC) operated by Carnegie Mellon University.
QRadar: Impact of Deploy Full Configuration on events, flows, and offenses
What is the impact of initiating a Deploy Full Configuration on QRadar systems?

Documentation technique, API et exemples de code | Microsoft Docs
docs.microsoft.com est le site qui regroupe la documentation Microsoft pour les utilisateurs finaux, les développeurs et les professionnels de l’informatique. Consultez nos démarrages rapides, tutoriels, références sur les API et exemples de code.