JJebitok·Oct 26The O365 Intrusion - Splunk (TryHackMe)Link to the O365 Intrusion on TryHackMe Active investigation High Situation Report Vantage Dynamics' IT team escalated a report from their Accounts Payable department on 27 August. An employee, Marc5 min read·sharonjebitok.com
JJebitok·Oct 26The Finance Trail - Splunk (TryHackMe)Link to the Finance Trail challenge on TryHackMe Case Briefing The numbers do not add up. You have been brought on at THM Security Services (TSS). Click the card below to reveal your role on this case7 min read·sharonjebitok.com
JJebitok·Oct 26Benign - Splunk (TryHackMe)Link to Benign challenge on TryHackMe Introduction We will investigate host-centric logs in this challenge room to find suspicious process execution. To learn more about Splunk and how to investigate3 min read·sharonjebitok.com
Rroutetoroot·Sep 29Lab 24: The Attack Ran. The Alerts Fired.I ran a live SSH brute force simulation against Kali Linux. Splunk fired 15 real-time alerts in under 2 seconds. Here's the full detection pipeline breakdown.4 min read·blog.routetoroot.io1
JJebitok·Sep 23Zero Tolerance (TryHackMe)Link to the challenge on TryHackMe: Zero Tolerance It was supposed to be a regular morning at ProbablyFine Ltd. L2 had just returned from paternity leave. L3 was hosting a live webinar on "Proactive7 min read·sharonjebitok.com3B
JJebitok·Sep 23Promotion Night: Splunk (TryHackMe)Link to the challenge on TryHackMe: Promotion Night It was a glorious Friday at ProbablyFine Ltd. After weeks of sales calls and PoC demos, the team finally signed a contract with DeceptiTech - a maj16 min read·sharonjebitok.com
Rroutetoroot·Sep 22Lab 23: Writing My First Splunk Detection RuleHow I wrote an SPL query to detect SSH brute force activity, configured a real-time Splunk alert, and validated it against 75 live events.4 min read·blog.routetoroot.io
JJebitok·Sep 22Splunk: Exploring SPL (TryHackMe)Link to the challenge on TryHackMe: Splunk: Exploring SPL index=windowslogs index=windowslogs earliest="04/15/2022:08:05:00" latest="04/15/2022:08:06:00" | stats count index=windowslogs EventI2 min read·sharonjebitok.com
Rroutetoroot·Sep 11Lab 22: Same Logs, New SIEM — Setting Up Splunk From ScratchHow I installed Splunk Enterprise 10.2.2 on Kali Linux, configured auth.log ingestion, and confirmed 76 SSH brute force events indexed.4 min read·blog.routetoroot.io
JJebitok·Sep 9Response and Recovery (TryHackMe)Link to the challenge on TryHackMe: Response and Recovery Introduction Response and Recovery picks up where Detection and Analysis left off: the investigation into the compromised l.chen@nexusfinancia2 min read·sharonjebitok.com
