Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
network logs
Understanding Network Logs What is a Network Log? Network logs are structured records of events and traffic observed by network devices and monitoring tools such as firewalls, routers, IDS/IPS, and…
ids lab
IDS Lab - Using Snort & Suricata Lab Goals Learn how to: Use Snort and Suricata Create and test custom detection rules Simulate attacks (ping, Nmap, Nikto, curl, etc.) Monitor and analyze alerts 1.…
socScripting
Scripting for SOC Tasks Intro Scripting is a vital skill for SOC analysts to automate routine tasks, analyze data, and respond to incidents efficiently. This chapter covers the fundamentals of Python…
scripting for soc
Scripting for SOC Tasks Automate repetitive tasks analyze logs and events 1. Basic Python Scripting Key Concepts Parsing Simple Logs (CSV & JSON) CSV (Comma-Separated Values) logs: Common for exported…
scapy lab solution
Lab Solution: Covert TCP Channel This document contains the solution for the Scapy Covert TCP Channel lab. It includes two ready-to-run Python scripts ( sniffer_covert_tcp.py and sender_covert_tcp.py…
scapy lab
Lab: Covert TCP Channel This file does NOT include the full solution code . Use this to write your own and (or to understand what to look for in the solution). Overview — what you'll build You will…
powershell for soc
1. System Information Gathering Get basic system details: Get current user and logged-in users: List local users and groups: Check process list and services: 2. Log Collection and Event Analysis List…
lab2 collect system info
Lab 2: PowerShell - Collect Basic System Info and Save to File Goal In this lab, you'll write a PowerShell script to collect essential system information and save it to a file. This is especially…
lab1 detect brute force
Lab 1: Python - Detect Brute Force Attempts from a JSON Log File Goal In this lab, you'll write a Python script to analyze a JSON log file containing authentication events. Your goal is to detect…
toolsAndPlatforms
Security Tools & Foundational Platforms Security tools and foundational platforms are the core technologies used to detect, investigate, and respond to cyber threats. These include tools that collect…
elasticLabLocal
Elastic Local Lab Please go though the documenation and setup for the Local Version Now that we have set up Elastic , Kibana and Filebeat , we can finally get our hands dirty and learn how a SOC…
elasticLabCloud
Please go though the documenation and setup for the Cloud Version Elastic Cloud Lab GOAL Set up and use Elastic SIEM on your system Learn how to ingest logs and visualize them Learn how to use SIEM…