Dear Blue Team - Proactive Steps to Supercharge Your IR

Explore proactive incident response strategies in this conference talk from NolaCon 2018. Delve into threat intelligence, various forensics types, and threat hunting techniques. Learn the differences between digital forensics and threat hunting, and discover the importance of comprehensive logging. Develop essential soft skills for effective incident response. Gain insights into memory analysis, SysInternals tools, Prefetch, and Shimcache. Establish baseline practices, explore network forensics, and master packet analysis. Understand the value of threat intelligence feeds, VirusTotal, and Linux tools like SIFT. Enhance your blue team capabilities with practical steps to supercharge your incident response processes.

Syllabus

Introduction
Why this topic
Threat Intelligence
Types of forensics
Threat hunting
Digital forensics vs threat hunting
Log everything
Soft skills
Memory analysis
SysInternals
Prefetch
shimcache
Baseline
Network forensics
Pcaps
Memory Capture
Packet Analysis
Threat Intelligence Feed
Virus Total
Linux VM
MRI
Sift
Closing