Social 📸 Photography

Alejandro BaezI been messing around trying self hosted options for logs. Mostly to scratch an itch, but also to know what is available in the market.<a href="https://fosstodon.org/tags/openObserve" class="mention hashtag" rel="nofollow noopener" target="_blank">#openObserve</a> is nice, but feels pretty clunky for what I want. Found this thing called <a href="https://fosstodon.org/tags/seq" class="mention hashtag" rel="nofollow noopener" target="_blank">#seq</a>, which is kind of brilliant. But right now, I've settled with <a href="https://fosstodon.org/tags/victorialogs" class="mention hashtag" rel="nofollow noopener" target="_blank">#victorialogs</a> from <a href="https://fosstodon.org/tags/victoriametrics" class="mention hashtag" rel="nofollow noopener" target="_blank">#victoriametrics</a>. It can ingest <a href="https://fosstodon.org/tags/elasticsearch" class="mention hashtag" rel="nofollow noopener" target="_blank">#elasticsearch</a> formatted logs. But you get the ease that <a href="https://fosstodon.org/tags/loki" class="mention hashtag" rel="nofollow noopener" target="_blank">#loki</a> was trying to do. I have to say, I'm impressed. 😄<a href="https://docs.victoriametrics.com/victorialogs/logsql/" rel="nofollow noopener" translate="no" target="_blank">https://docs.victoriametrics.com/victorialogs/logsql/</a>

MalwareLabDuring the <a href="https://infosec.exchange/tags/SharkBytes" class="mention hashtag" rel="nofollow noopener" target="_blank">#SharkBytes</a> session at <a href="https://infosec.exchange/tags/SharkFest" class="mention hashtag" rel="nofollow noopener" target="_blank">#SharkFest</a> conference I had an opportunity to present a lightning talk about my pet project called IDS Lab. It is a lab infrastructure deployable as docker containers, which simulates the small company network.The IDS Lab consists of web webserver with <a href="https://infosec.exchange/tags/Wordpress" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wordpress</a>, <a href="https://infosec.exchange/tags/MySQL" class="mention hashtag" rel="nofollow noopener" target="_blank">#MySQL</a> database, <a href="https://infosec.exchange/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> desktop with RDP, the <a href="https://infosec.exchange/tags/WireGuard" class="mention hashtag" rel="nofollow noopener" target="_blank">#WireGuard</a> VPN for "remote" workers and for connecting another virtual or physical machines into the lab network. This part of infrastructure can be used for attack simulations.There are additional components for playing with logs and detections, too: <a href="https://infosec.exchange/tags/Fluentbit" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fluentbit</a>, <a href="https://infosec.exchange/tags/Suricata" class="mention hashtag" rel="nofollow noopener" target="_blank">#Suricata</a> and <a href="https://infosec.exchange/tags/OpenObserve" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenObserve</a> as lightweight SIEM. In the <a href="https://infosec.exchange/tags/SIEM" class="mention hashtag" rel="nofollow noopener" target="_blank">#SIEM</a> we already have preconfgured dashboards for alerts, netflows, web logs and logs from windows machines, if present.Using the provided setup script, the whole lab can be up and running in up to 5 minutes. For more info, please check my GitHub repository with the IDS Lab:<a href="https://github.com/SecurityDungeon/ids-lab/" rel="nofollow noopener" translate="no" target="_blank">https://github.com/SecurityDungeon/ids-lab/</a><a href="https://infosec.exchange/tags/sf24eu" class="mention hashtag" rel="nofollow noopener" target="_blank">#sf24eu</a> <a href="https://infosec.exchange/tags/wireshark" class="mention hashtag" rel="nofollow noopener" target="_blank">#wireshark</a> <a href="https://ioc.exchange/@wireshark" class="u-url mention" rel="nofollow noopener" target="_blank">@wireshark</a>

Özkan Pakdil 🦖Since morning I am searching for a nice free log analyzer, I used <a href="https://techhub.social/tags/splunk" class="mention hashtag" rel="nofollow noopener" target="_blank">#splunk</a> around 12 years just wanted to search quickly on some application logs, most probably log4j or log4net logs. I tried - <a href="https://techhub.social/tags/ELK" class="mention hashtag" rel="nofollow noopener" target="_blank">#ELK</a><-too hard to install configure - <a href="https://techhub.social/tags/graylog" class="mention hashtag" rel="nofollow noopener" target="_blank">#graylog</a><-too complex or non working docs - <a href="https://techhub.social/tags/jaeger" class="mention hashtag" rel="nofollow noopener" target="_blank">#jaeger</a><-wanted json format - <a href="https://techhub.social/tags/openobserve" class="mention hashtag" rel="nofollow noopener" target="_blank">#openobserve</a><-does not have simple log upload or file path provider, needs fluentd or kubectlI did not know splunk is this good, now I am convinced it is super product. Feel free to tell if you have a good suggestion and boost please for reach.

Recent searches

Search options

Administered by:

Server stats:

#openobserve