An Elasticsearch Watcher is typically paired with a Kibana Saved Search to identify the events which caused it to fire. This post demonstrates how a Watcher can use the Apache Lucene style query from a Saved Search, ensuring the Watcher remains aligned as the query evolves.
Packet capture on Windows typically requires the installation of a specialised tool. In most cases this tool requires some form of kernel driver. In this post we demonstrate how to capture IP packets on Windows without requiring any extra software or drivers to be installed.
YARA from VirusTotal is a powerful tool that can be used to identify and classify malware. In this post we demonstrate how it can be employed to scan email, in real-time, using the NoSpaceships open-source yaraka project.