Knowledgebase

  1. Portal Home
  2. Knowledgebase
  3. Viewing articles tagged Incident Response

  Categories

Help Center
13
IT Guides
107

  Categories

  Tag Cloud

3-2-1 Backup Rule Active Directory AD DS AD LDS AD Objects AD Security AD Snapshots AdExplorer AES-256 AI in auditing AKS Alerts Ansible App Service Application Delivery Controller application packaging AsJob audit policy authentication policies Automation Autoruns autostart locations availability zones AWS AWS billing alerts AWS budgets AWS Cost Explorer AWS KMS AWS S3 AWS Security Hub Azure Azure CDN Azure fundamentals Azure Key Vault Azure Security Center Azure SQL Database Background Jobs backup automation backup encryption bash bash scripting BitLocker boot sector bulk import Business Continuity BYOK Certificate Management chain of custody Change Management CI/CD CI/CD security CIM CimSession Citrix NetScaler Cloud Backup cloud compliance Cloud Computing cloud cost optimization cloud database cloud encryption cloud infrastructure cloud migration cloud performance cloud security cloud storage security Cluster Management Community Engagement Compliance compliance policies conditional access configuration management Container Orchestration container security content delivery Credential Guard Credential Security CredSSP cron jobs crontab cryptography CSPM Cybersecurity cybersecurity frameworks Cybersecurity Investigation daemon.json hardening data migration Data Protection data-at-rest encryption database security DBaaS dependencies detection engineering detection rules DevOps DevOps Automation DevSecOps DFIR DHCP digital forensics Disaster Recovery Disk Monitoring DNS docker security Domain Controllers DPAPI DS Access DSC DSN Management Dynamic Parameters EC2 right-sizing edge caching EDR elastic pools Elasticity encryption encryption at rest encryption hardening endpoint management endpoint protection endpoint security Enterprise Scripting ESXi etcd ETW event logs evidence collection evidence preservation fastcgi cache Fault Tolerance Firewall Management For loop ForEach forensic triage Forest Functional Level FQDN functions GCP GCP KMS GDPR Get-NetAdapterRsc GitHub GitHub Actions GitHub Discussions GPO backup GPO management Group Policy Group Policy troubleshooting hardening high availability hybrid security Hyper-V Hyper-V containers IAM identity security ike hardening immutable backups Import-Module incident post-mortem Incident Response infrastructure automation Install-Module Intune IntuneWinAppUtil Invoke-Command Invoke-RestMethod IoT security IP analysis IP hash ipsec IT Administration IT Audit IT auditing IT Automation IT Collaboration IT Infrastructure IT Management IT Operations IT security standards JEA Just Enough Administration KAPE kerberos Kerberos Hardening key management key rotation KMS KQL Kubernetes least connections Least Privilege linux linux automation linux backup Load Balancing loops malware analysis managed database MDM memory leak microsegmentation Microsoft 365 Microsoft Defender Microsoft Defender for Cloud Microsoft Endpoint Manager Microsoft Intune Microsoft Sentinel Microsoft Teams misconfigurations MITRE ATT&CK Module Management module manifest multi-cloud multipartite virus naming conventions NetAdapter NetBIOS NetEventPacketCapture NetIPsec netsecurity netsecurity module Network Adapters Network Automation network capture network diagnostics Network Management Network Operations Network Optimization Network Performance Network Security network troubleshooting Networking Nginx NIC Configuration NTFS Forensics NTLM ODBC Office 365 Offsite Backup OutBuffer OWASP packet capture Parameters patch management penetration testing performance Performance Tuning persistence detection Pester php-fpm Pipeline pipeline as code pipeline security PKI PolicyStore Post-Mortem PowerShell PowerShell Gallery PowerShell Modules PowerShellGet prepared statements Prisma Cloud Privileged Access Management Process Explorer process management procmon PSD1 ransomware ransomware defense Ransomware Protection RBAC RDM RDMA Receive Segment Coalescing red team Region Selection Registry Analysis Remote Administration Remote Management Replication REST API reverse proxy round robin RSAT Scalability Script Testing Scripting secrets management secure coding Secure Score SecureString Security Security as a Service security audit security baselines security monitoring security posture security testing Select-Object server management serverless Service Management SharePoint 2016 SharePoint administration SharePoint Governance SharePoint lists shell scripting SIEM SIEM detection Site Collection Administrators SMB SMB Direct SOC SQL injection SQL Server sre SSL Offloading Start-NetEventSession StarWind Stop-NetEventSession Storage Spaces Direct supply chain Sysadmin Sysinternals System Administration systemctl tabletop exercises tar backup Teams Administration threat detection threat hunting threat intelligence ThrottleLimit tier 0 troubleshooting Tutorials UAC USB forensics Validation variables Veeam Veeam Cloud Connect versioning VFP Virtual Tape Library virtualization VM Scale Sets VMDK VMMap VMware VMware vSphere vSphere 6.7 vSphere administration vulnerability scanning WAF web application security web performance Web Server Win32_Service Windows Admin Center Windows administration Windows Autopilot windows boot Windows Digital Forensics Windows forensics Windows Group Policy Windows performance Windows Registry Windows Security Windows Server Windows Server 2025 Windows Services WinRM WMI wordpress XaaS yaml Zero Trust

  Support

My Support Tickets
News
Knowledgebase
Downloads
Network Status
Open Ticket

Viewing articles tagged 'Incident Response'

PowerShell Providers: Navigate the Registry Like a Filesystem A managed services client called us at 2 AM because a fleet of 180 Windows Server 2022 boxes had stopped autoloading their LOB agent after a botched GPO push. The Powe… 4 min read Multipartite Virus: Hunting Multi-Vector Malware in Production A manufacturing client called us on a Tuesday morning with a problem that didn’t add up. Their endpoint agent had flagged and quarantined a suspicious executable on th… 7 min read MITRE ATT&CK Integration in Tabletop Exercises: A Checklist Last quarter, we facilitated a tabletop exercise for a financial services client. Their CISO was confident the IR team could handle a ransomware scenario. Forty-five m… 7 min read Internal vs External IP Analysis in Threat Hunting Your SIEM fires a high-severity alert at 3 AM. A workstation on the finance VLAN just made an outbound connection to an IP address flagged in three threat intelligence… 8 min read Windows USB Forensics: Tracking External Device Connections A financial services client called us on a Friday afternoon. Their DLP solution flagged 14 GB of data copied to a removable device, but the employee had already left t… 8 min read Ransomware Encryption Analysis: Attack Mechanics on Windows A managed services client called our SOC at 2:14 AM on a Tuesday. Their file server was throwing access denied errors across three departments. By 2:20 AM we had confi… 5 min read Using Autoruns to Audit Every Windows Autostart Location During a quarterly security review for a client running a 200-seat Windows environment, we found a DLL registered under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersi… 7 min read Forensic Triage on Windows: Rapid Evidence Collection Your SIEM flags a suspicious PowerShell execution on a domain controller at 11:43 PM. The endpoint detection tool confirms process injection consistent with MITRE ATT&… 8 min read Digital Forensics for Incident Response: Field Guide Three weeks into a ransomware investigation at a mid-size logistics firm, the IR team handed me what they called a “forensic copy” of the infected server. It had been… 9 min read Cybersecurity Naming Conventions: A Complete IT Guide Cybersecurity naming conventions are standardized rules for labeling digital assets – including user accounts, firewall rules, log files, and security policies. Organi… 8 min read Windows Digital Forensics Guide for IT Security Teams When a security incident occurs on a Windows system, the clock starts ticking immediately. Every action taken – or not taken – can determine whether critical evidence… 9 min read
Back

  Tag Cloud

3-2-1 Backup Rule Active Directory AD DS AD LDS AD Objects AD Security AD Snapshots AdExplorer AES-256 AI in auditing AKS Alerts Ansible App Service Application Delivery Controller application packaging AsJob audit policy authentication policies Automation Autoruns autostart locations availability zones AWS AWS billing alerts AWS budgets AWS Cost Explorer AWS KMS AWS S3 AWS Security Hub Azure Azure CDN Azure fundamentals Azure Key Vault Azure Security Center Azure SQL Database Background Jobs backup automation backup encryption bash bash scripting BitLocker boot sector bulk import Business Continuity BYOK Certificate Management chain of custody Change Management CI/CD CI/CD security CIM CimSession Citrix NetScaler Cloud Backup cloud compliance Cloud Computing cloud cost optimization cloud database cloud encryption cloud infrastructure cloud migration cloud performance cloud security cloud storage security Cluster Management Community Engagement Compliance compliance policies conditional access configuration management Container Orchestration container security content delivery Credential Guard Credential Security CredSSP cron jobs crontab cryptography CSPM Cybersecurity cybersecurity frameworks Cybersecurity Investigation daemon.json hardening data migration Data Protection data-at-rest encryption database security DBaaS dependencies detection engineering detection rules DevOps DevOps Automation DevSecOps DFIR DHCP digital forensics Disaster Recovery Disk Monitoring DNS docker security Domain Controllers DPAPI DS Access DSC DSN Management Dynamic Parameters EC2 right-sizing edge caching EDR elastic pools Elasticity encryption encryption at rest encryption hardening endpoint management endpoint protection endpoint security Enterprise Scripting ESXi etcd ETW event logs evidence collection evidence preservation fastcgi cache Fault Tolerance Firewall Management For loop ForEach forensic triage Forest Functional Level FQDN functions GCP GCP KMS GDPR Get-NetAdapterRsc GitHub GitHub Actions GitHub Discussions GPO backup GPO management Group Policy Group Policy troubleshooting hardening high availability hybrid security Hyper-V Hyper-V containers IAM identity security ike hardening immutable backups Import-Module incident post-mortem Incident Response infrastructure automation Install-Module Intune IntuneWinAppUtil Invoke-Command Invoke-RestMethod IoT security IP analysis IP hash ipsec IT Administration IT Audit IT auditing IT Automation IT Collaboration IT Infrastructure IT Management IT Operations IT security standards JEA Just Enough Administration KAPE kerberos Kerberos Hardening key management key rotation KMS KQL Kubernetes least connections Least Privilege linux linux automation linux backup Load Balancing loops malware analysis managed database MDM memory leak microsegmentation Microsoft 365 Microsoft Defender Microsoft Defender for Cloud Microsoft Endpoint Manager Microsoft Intune Microsoft Sentinel Microsoft Teams misconfigurations MITRE ATT&CK Module Management module manifest multi-cloud multipartite virus naming conventions NetAdapter NetBIOS NetEventPacketCapture NetIPsec netsecurity netsecurity module Network Adapters Network Automation network capture network diagnostics Network Management Network Operations Network Optimization Network Performance Network Security network troubleshooting Networking Nginx NIC Configuration NTFS Forensics NTLM ODBC Office 365 Offsite Backup OutBuffer OWASP packet capture Parameters patch management penetration testing performance Performance Tuning persistence detection Pester php-fpm Pipeline pipeline as code pipeline security PKI PolicyStore Post-Mortem PowerShell PowerShell Gallery PowerShell Modules PowerShellGet prepared statements Prisma Cloud Privileged Access Management Process Explorer process management procmon PSD1 ransomware ransomware defense Ransomware Protection RBAC RDM RDMA Receive Segment Coalescing red team Region Selection Registry Analysis Remote Administration Remote Management Replication REST API reverse proxy round robin RSAT Scalability Script Testing Scripting secrets management secure coding Secure Score SecureString Security Security as a Service security audit security baselines security monitoring security posture security testing Select-Object server management serverless Service Management SharePoint 2016 SharePoint administration SharePoint Governance SharePoint lists shell scripting SIEM SIEM detection Site Collection Administrators SMB SMB Direct SOC SQL injection SQL Server sre SSL Offloading Start-NetEventSession StarWind Stop-NetEventSession Storage Spaces Direct supply chain Sysadmin Sysinternals System Administration systemctl tabletop exercises tar backup Teams Administration threat detection threat hunting threat intelligence ThrottleLimit tier 0 troubleshooting Tutorials UAC USB forensics Validation variables Veeam Veeam Cloud Connect versioning VFP Virtual Tape Library virtualization VM Scale Sets VMDK VMMap VMware VMware vSphere vSphere 6.7 vSphere administration vulnerability scanning WAF web application security web performance Web Server Win32_Service Windows Admin Center Windows administration Windows Autopilot windows boot Windows Digital Forensics Windows forensics Windows Group Policy Windows performance Windows Registry Windows Security Windows Server Windows Server 2025 Windows Services WinRM WMI wordpress XaaS yaml Zero Trust

  Support

My Support Tickets
News
Knowledgebase
Downloads
Network Status
Open Ticket