Loginsoft Blogs
Security Products: Challenge, Accessibility, Approach to test
We are often asked by our clients to setup security firewalls and networking products in a lab environment using popular emulators like EVE-NG or GNS3 etc. It is always not easy to find ways to emulate different security network products, but we are able to find...
Discock Stealer – Another Polymorphic Malware like WASP Stealer
What is the package name: http5 When was it released: Jan 3, 2023 Which version we are talking about: 0.0.1 How many times it was downloaded in 30 days: 61 What the package says it to be: “A small example package” Where we started We first observed a package...
Threat Intelligence Connector for OpenCTI Cyber Threat Intelligence Platform
OpenCTI is an open source threat intelligence platform developed by Filigran in collaboration with French national cybersecurity agency (ANSSI), CERT-EU and Luatix. Organizations can manage threat intelligence knowledge and observables such as TTPs structuring data in...
Open Vulnerability Assessment Language (OVAL) in a Nutshell – Part 2
Introduction This blog post is in continuation to our previous post titled Open Vulnerability Assessment Language in a Nutshell. To further explain about the OVAL, let’s consider the latest CVE (CVE-2022–0540) for the Atlassian Jira Server product. This vulnerability...
Detecting Atlassian Confluence Exploitation – CVE-2022-26134
Context Background Atlassian has published a security advisory CVE-2022-26134 on June 2, for its Confluence Server and Data Center, regarding zero-day vulnerability. Several customer environments were being compromised with the unauthenticated activity and for which...
Cisco Umbrella Reporting Integration with Cortex XSOAR
Security teams are constantly flooded with alerts from multiple systems. Using the Cisco Umbrella Reporting API, security analysts can programmatically pull contextual threat intelligence from the Global Network into their Security Management, Incident, Orchestration...
Open Vulnerability Assessment Language (OVAL) in a Nutshell
Before diving into the OVAL, we shall quickly brief the project from where it has evolved. Overview of SCAP Security Content Automation Protocol (SCAP), a project from NIST is widely adopted by many software and hardware manufacturers as a sophisticated framework of...
Palo Alto Networks Cortex XSOAR Integration
The changing threat landscape in cybersecurity has highlighted the need for a platform that centralizes intelligence from various sources in order to perform an effective security operation and workflow. Cortex XSOAR combines both security orchestration and incident...
Is it time for leading Threat Intelligence Platforms to support custom objects such as Wallet IDs, Cryptocurrency address for Cryptocurrency Threat Intelligence providers?
The Financial Crimes Enforcement Network (FinCEN) has named “Cybercrime, including relevant cybersecurity and virtual currency considerations” a national priority. In June 2021, President Joe Biden issued a directive to federal agencies to prioritize efforts to...
Emerging Threats and Vulnerabilities in Cybersecurity
Loginsoft Research Team has been monitoring several exploits from the dedicated servers that were deployed globally for the purpose of threat discovery. The team analyzes and enriches this data to identify behavior, methods and intent of the Threat actors. The...
Fast Incident Response (FIR) Integration with Threat Intelligence Management Platform (IMP)
Organizations today face a critical Cyber Threat Landscape as more software and hardware systems are becoming vulnerable to cyberattacks. Loginsoft has developed an Integration that ingests Fast Incident Response (FIR) Incidents/Events into the Intelligence Management...
How can you speed up Incident Response on ServiceNow for Automated Enrichment of security incidents using Threat Intelligence ?
Today, most enterprise customers have a manual Swivel-Chair Enrichment processes where Level 1 or Level 2 incident handlers within the security operation center are Swivel-Chairing and logging into external systems. An example is to perform observable look up in...
IBM QRadar Use Cases
What should I build on IBM QRadar to effectively manage and investigate the alerts? The guide for Product Managers to explore Security Use Cases. In an age where cyber threats are widespread, it is important that organizations keep their data secure. The IBM QRadar...
Is Microsoft Azure Sentinel your next Implementation? Learn how Loginsoft integrated Sentinel with data source
Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Built on the foundation of Azure Logic Apps, Azure Sentinel's automation and...
Loginsoft builds expertise in integrating Threat Intelligence source with ThreatQuotient’s Threat Intelligence Platform
ThreatQ platform has taken a threat-centric approach to security operations. This approach allows security teams to prioritize based on threat and risk, collaborate across teams, automate actions and workflows, and integrate point products into a single security...
Loginsoft builds expertise in integrating Threat Intelligence sources into ThreatConnect (SOAR) platform
With both Security Orchestration Automation and Response (SOAR) and Threat Intelligence Platform (TIP) capabilities, ThreatConnect unites intelligence, automation, orchestration and response to enable organizations to be more predictive, proactive and efficient....
How Osquery Works and How Osquery FIM benefits Security Researchers
This article exclusively helps the beginners out there, who are willing to learn and explore Osquery. Initially, we would like to explain the mechanism and the technical terms related to Osquery functionality and also give examples to demonstrate how Osquery works. We...
Explicating the Concepts of Osquery
What is Osquery? Osquery is a universal system security monitoring and an intrusion tool which specially focuses on your operating system. Imagine a completely open-source tool which empowers you with monitoring the high-end file integrity by turning your operating...
A New Approach to Accelerate Threat Detection
This article explains the importance of early threat detection and illustrates in detail about how a SIEM solution like Splunk can be useful in threat detection and incident response. SIEM is one of the several technologies that are used to detect...
Threat Detection with SIGMA Rules
Incident Response is the action that you take to restore the ability to deliver organization business service. It is also known as IT incident, computer incident, or security incident. The main objective of the Incident Response is to handle the situation in a way...
US Office
4437 Brookfield Corporate Drive, Suite 101 Chantilly, VA USA 20151
7-7003 Steeles Ave W, Toronto,
ON M9W 0A2, Canada
India Office
1-63-5-8B, Kavuri Hills, Jubilee Hills, Hyderabad-500033