Omer Yampel

Beagle accelerates incident response by transforming security data (e.g Sysmon logs or memory) from hosts into graphs. Includes a web interface to generate and analyze graphs. See it live Friday at @BlackHatEvents #BHASIA @ToolsWatch. github.com/yampelo/beagle #threathunting #dfir

@vxunderground hola

@vxunderground @flopyash 🤞

Giveaway #??? Our friend @flopyash hooked us up with 5 tickets for the Certified Purple Team Analyst course. Comment below for a chance to win:) Course details: cyberwarfare.live/product/purple…

@Diablo #DemonMeatShake + #DiabloPromo

@Diablo Tweet #LilithIsComing + #DiabloPromo

Prepare to summon the Daughter of Hatred. Tweet #LilithIsComing + #DiabloPromo and you may receive a gift to aid you in your rituals. 📜 RULES: fooji.info/diablo4

@Warcraft Resonatorrob Illidan US #warcraftstory

#Dragonflight nears and every adventurer has a unique story to tell! Tweet the following to get your #WarcraftStory ✍ Your Character’s Name ✍ Realm ✍ Region (US, EU, TW or KR) ✍ #WarcraftStory ✍ @Warcraft

@NathanMcNulty @olafhartong @securityfreax @RavivTamir Does this still work? giving us errors this morning

@yampelo @olafhartong @securityfreax @RavivTamir POST security.microsoft.com/apiproxy/mtp/h… JSON too big for Twitter:

We're planning to drop Sysmon in favor of WDATP. (Yes, sysmon) Does anyone know a mapping for sysmon <-> WDATP events? We want to make sure, that dropping sysmon in favor of WDATP won't lead to lacks in telemetry & dectection. Any recommendations? cc @RavivTamir

@olafhartong @securityfreax @RavivTamir Got an example? i really hoped i wouldn’t just have to do what i see my browser do from developer tools lol

@yampelo @securityfreax @RavivTamir Currently you can do it if you’re a bit creative with the website API. There is a proper API coming (hopefully soon) but still not public yet

@olafhartong @securityfreax @RavivTamir Have you found a way to deploy custom detection rules to MDATP via the API? the same way i can create a saved search in splunk, we haven’t found a way and it’s really ruining managing MDATP for us :(

@securityfreax @RavivTamir If you have Sysmon rolled out. Please keep it on the boxes, even if you don’t ingest the data it will be great for IR and doesn’t hurt you. Next focus on getting the most out of MDE, this includes building custom detections. Then consider filling in the blind spots with Sysmon.

is there really no way to programmatically create rules in defender atp? it’s all via the gui?

@BlueDrewLIVE @WarcraftDevs my team is ranked 300-350th right now, we probably won’t get rank 1 titles because we can’t get spots while crusader has 8 paladins above 3.2

. @WarcraftDevs I know this only effects like ~200 people but end of season titles should be one per class/account. Playing the same comp with the same people on 4/5 of the same class creates harmful situations for the ladder and would give up-n-comers a better chance to push.

@subTee this was one of the first datasets i added graph support in github.com/yampelo/beagle for to explore as its well documented and structured

Less than 2 weeks to go to get your submission in to present at #VeloCON on 9/15. This is your chance to share your passion and expertise of Velociraptor with the rest of our community on a global, virtual forum. Submit your presentation here: docs.velociraptor.app/announcements/…

@ChickfilA i think in four times of going there, the chick fil a on 42nd infront of grandcentral has never given me a fully cooked through chicken sandwich. its always rubbery :(

@meansec I have no team this year :'(

Signups for bots.splunk.com are open. You can play in person or virtual! I just got to go through my first blind alpha test ever... But I have to say I think this Boss of the SOC thing has some legs. It's pretty cool.

science has gone too far

@velocidex so cool!

Do you love using @velocidex Velociraptor? Do you want to share your tips or experience with the community? Now is your chance! Call for presentations are now open for the September VeloCon. docs.velociraptor.app/announcements/…

1/ Our newest, @CR_Nocturnus research is out! 🇨🇳🔥 Uncovering a global #Chinese #espionage campaign, performing a massive multi-year intellectual property theft, carried out by the #Winnti (#APT41) group. cybereason.com/blog/operation…

@InsanityBit can’t you just docker run the container still? that works for me

So Splunk got rid of the "run community version locally" thing? Seems like you have to email them, agree to a demo, and... maybe then they let you have it? wtf lol

@kirstasty what a throwback lol

HOW DID I JUST FIND OUT CENTENNIAL YEAR BOOKS ARE ARCHIVED ONLINE AS PDFs ITS A GREAT DAY TO BE A CHARGER BAYBEE!! issuu.com/centurianarchi…

@playlostark why no mac support :(