Summit Route - How to write security alerts

summitroute.com · 2,977 words · saved by 1 readers

A defender’s job is not only to stop bad things from happening, but also to detect issues as they occur so mitigating actions can be taken before they become bad (or worse). Alerts are how you do this. This post gives advice on using alerts for security purposes. Much of this also relates to alerts for DevOps. I use the word “alert” to mean either the notification message that results from something searching logs, or the rule that defines the logic used to search logs and causes this notification. For example, I find it valid to say “I received an alert from the alert I wrote” which would mean “I received a notification from the rule I wrote.” I’ve tried to clarify their uses. Send your logs to a central location. This is important both to ensure the integrity of the logs (so the attacker on a host doesn’t wipe the logs), and to make them easier to work with than having to ssh, grep, and less through them somewhere. An ELK stack with ElastAlert, as I described in my post Iterative Def

Summit Route - How to write security alerts How to write security alerts 2016.11.22 RSS feed A defender’s job is not only to stop bad things from happening, but also to detect issues as they occur so mitigating actions can be taken before they become bad (or worse). Alerts are how you do this. This post gives advice on using alerts for security purposes. Much of this also relates to alerts for DevOps. I use the word “alert” to mean either the notification message that results from something searching logs, or the rule that defines the logic used to search logs and causes this notification. For

Summit Route - How to write security alerts

related reading