ISE5501

This serves as a repository of links, configuration files, and procedures related to my ISE5501 course at SANS Technology Institute.

• Required Modification to ossec.conf on hosts

• Malware Archeology Windows Logging Cheat Sheet (Archived Version). To ensure you review the most recent version, please visit [https://www.malwarearchaeology.com/cheat-sheets]

• Malware Archeology Logging Cheat Sheet mapped to MITRE ATT&CK (Archived Version). To ensure you review the most recent version, please visit https://www.malwarearchaeology.com/cheat-sheets

• Security Onion Sysmon Page

• Archived version of the SwiftOnSecurity Sysmon Configuration File

• Wazuh Agent Download

• Wazuh Instalation Guide

• Adding Wazuh agents to Security Onion

  • Ensure you also use so-allow to allow traffic through the local firewall. There are pre-defined rules for adding OSSEC agents.

• Wazuh Agent Install Directions

• Security Onion Wazuh wiki page