iiinova — where your digital self keeps evolving

Reposted by Mike Wilkinson

Brian Carrier @carrier4n6.bsky.social · 01/04/2025

Learn from 4 IR experts on how they do Endpoint Triage. Apr 17. I'll MC and you'll hear from @keydet89.bsky.social (Huntress), Kai Thomsen (Dragos), @dfirmike.bsky.social (Sleuth Kit Labs) and Quinnlan Varcoe (Blueberry Security). See you there! register.gotowebinar.com/register/600...

021

Reposted by Mike Wilkinson

Brian Carrier @carrier4n6.bsky.social · 21/03/2025

For those in the #SOC: Alert Triage vs Endpoint Triage Blog post that is part of our Endpoint Triage series. Alert triage focuses on validating and prioritizing the EDR/SIEM alert. Endpoint triage focuses on prioritizing the host. How bad is it? www.cybertriage.com/blog/alert-t...

cybertriage.com

Alert Triage vs Endpoint Triage: What SOCs Need to Know

As we talk to corporate security teams about how they respond to incidents and EDR alerts, we find it useful to highlight the Endpoint Triage step in

044

Reposted by Mike Wilkinson

Brian Carrier @carrier4n6.bsky.social · 27/01/2025

We're using the term "Information Artifacts" for high-level #DFIR concepts like "Processes" and "Inbound Logins". I think they are easier to train than low-level Prefetch, UserAssist etc. (i.e. Data Artifacts). Those map to an Info Artifact (Prefetch -> Process). www.cybertriage.com/blog/informa...

cybertriage.com

Information Artifacts: Simplify DFIR Analysis

Do you know the differences between MUICache, ShimCache, AMCache, and PMCache without the help of Google? Did you know that one of them is made up?

141

Mike Wilkinson @dfirmike.bsky.social · 20/12/2024

This is a fascinating interview from @campuscodi.risky.biz about the actual productive use of LLMs in combating insider threats. Well worth the listen for a conversation around AI without a bunch of marketing BS. risky.biz/RBTALKS5/

risky.biz

RBTALKS5: How Pfizer uses AI to detect insider risk - Risky Business

RBTALKS5: How Pfizer uses AI to detect insider risk

000

Reposted by Mike Wilkinson

Cyber Triage @cybertriage.bsky.social · 19/12/2024

Cyber Triage 3.13 is the holiday gift you’ve been waiting for: Integrations that make you faster. → MemProcFS integration → Expanded S3 integration → Detailed sandbox report Complete 3.13 release notes: www.cybertriage.com/blog/release...

cybertriage.com

3.13 Adds MemProcFS and Extends the S3 and Recorded Future Sandbox Integrations

Our holiday gift this year is some frequently requested features that came out in the 3.13 release: MemProcFS to support Windows 10 and 11 images

1104