Red Team's SIEM
github.com
Red Team's SIEM
1–10 of 29 posts
Re: Red Team's SIEM
#2ELI5 please. why should I care about this.
Re: Red Team's SIEM
#3ELI5 please. why should I care about this.
This is about serious business security wargaming.
Re: Red Team's SIEM
#4ELI5 please. why should I care about this.
TLDR: highly sophisticated tools for cyber security analysts.
Yeah had the same reaction. It takes some background to get what they are taking about.
Red Team: A team that try to exploit an organisation to find weakness before black hackers find them. [1] Blue Team: A team that tries to protect the org from the red team and fix the exploits. [2] SIEM: Security Information and Event Management. Usually used by Blue teams. [3]
[1] https://en.wikipedia.org/wiki/Red_team [2] https://en.wikipedia.org/wiki/Blue_team_(computer_security) [3] https://en.wikipedia.org/wiki/Security_information_and_event...
PS: search skills are really important these days.
Re: Red Team's SIEM
#5ELI5 please. why should I care about this.
> "ELI5 please. why should I care about this."
Sounds like exactly the tool for your kind! ;)
Re: Red Team's SIEM
#6ELI5 please. why should I care about this.
TLDR: highly sophisticated tools for cyber security analysts. Yeah had the same reaction. It takes some background to get what they are taking about. Red Team: A team that try to exploit an organisation to find weakness before black hackers find them. [1] Blue Team: A team that tries to protect the org from the red team and fix the exploits. [2] SIEM: Security Information and Event Management. Usually used by Blue te…
I did the searching you mention, and I found the info you mention. But the link sucks on its own, for it to the #1 on HN, in my opinion.
The page is written with the philosophy: if you don't know what all these terms are, you don't belong here. Which is fine for a random Github repo.
I'd be curious to know about HN's sorting algorithms, this topic seems such a niche thing that I'm amazed this page reached #1...
Re: Red Team's SIEM
#7Earlier quoted context omitted.
TLDR: highly sophisticated tools for cyber security analysts. Yeah had the same reaction. It takes some background to get what they are taking about. Red Team: A team that try to exploit an organisation to find weakness before black hackers find them. [1] Blue Team: A team that tries to protect the org from the red team and fix the exploits. [2] SIEM: Security Information and Event Management. Usually used by Blue te…
I did the searching you mention, and I found the info you mention. But the link sucks on its own, for it to the #1 on HN, in my opinion. The page is written with the philosophy: if you don't know what all these terms are, you don't belong here. Which is fine for a random Github repo. I'd be curious to know about HN's sorting algorithms, this topic seems such a niche thing that I'm amazed this page reached #1...
People like to play cool. Everybody here is a wannabe top hacker, or wannabe unicorn startup founder, or a wannabe James Bond. Nothing is inherently wrong or unusual with that.
Re: Red Team's SIEM
#8Earlier quoted context omitted.
TLDR: highly sophisticated tools for cyber security analysts. Yeah had the same reaction. It takes some background to get what they are taking about. Red Team: A team that try to exploit an organisation to find weakness before black hackers find them. [1] Blue Team: A team that tries to protect the org from the red team and fix the exploits. [2] SIEM: Security Information and Event Management. Usually used by Blue te…
I did the searching you mention, and I found the info you mention. But the link sucks on its own, for it to the #1 on HN, in my opinion. The page is written with the philosophy: if you don't know what all these terms are, you don't belong here. Which is fine for a random Github repo. I'd be curious to know about HN's sorting algorithms, this topic seems such a niche thing that I'm amazed this page reached #1...
>The page is written with the philosophy: if you don't know what all these terms are, you don't belong here. Which is fine for a random Github repo.
It's also fine for a page meant for a specific audience. It's not like they want to attract random developers working outside security.
Whenever someone says something akin to "Hey that project's page didn't explain/market their offering well enough for me!", an obvious counter question is "and who said their intention was to promote it to you?".
Sometimes the complain is legitimate (e.g. a programming language or project that wants wide adoption should explain what it is clearly and attractively in its webpage). Other times it's just that not everybody is the intended audience, and they explain what they do well already if you're the intended audience (in which case you know the terms the use, etc).
>I'd be curious to know about HN's sorting algorithms, this topic seems such a niche thing that I'm amazed this page reached #1...
Perhaps enough people know about this stuff already and voted it as soon as they saw it? I didn't know what Red/Blue teams are, but there are several security people here that do.
Re: Red Team's SIEM
#9It's interesting to see the development of Red team tooling over the last couple of years.
It's obviously necessary for red teamers to continue to advance to be able to cope with improving Blue team technology.
However Red Team tech. is, by it's nature, dual-use. It's equally useful for "real" attackers to have these capabilities as it is for people emulating real attackers. The nature of open source makes these capabilities quickly distributable.
So these capabilities will help "real" attackers in the same way they help red teams...
Terminology - Red Team - Set of security professionals who emulate "real world" attackers in an attempt to find exploitable flaws in organizations systems. Blue Team - defensive security professionals who's job it is to detect and respond to attack from real atteckers and red teamers.
Re: Red Team's SIEM
#10[deleted]