#blue-team
All CosmicBytez Labs articles tagged #blue-team, across news, security advisories, how-to guides, and projects.
- HOWTO
Deploying ClamAV for Automated Antivirus Scanning on Linux Servers
Install and configure ClamAV to automatically scan file shares, mail queues, and uploaded files on Linux — with scheduled scans, quarantine, and real-time...
- HOWTO
Deploying Canarytokens for Early Breach Detection
Plant free honeytokens across file shares, AWS, email, and Active Directory so an intruder trips an alert the moment they touch something they shouldn't.
- HOWTO
Nmap for Network Asset Discovery and Security Auditing
Find every live host, open port, and service on your network before an attacker does. A practical walkthrough of Nmap scan types, service detection, NSE...
- HOWTO
Packet Analysis with Wireshark and tshark: A Practical Guide
Capture, filter, and triage network traffic like an analyst. Learn Wireshark display filters, tshark for headless captures, and how to spot common attack...
- HOWTO
Writing and Deploying YARA Rules for Malware Detection
Learn to write effective YARA rules to identify malware, hunt threats, and scan endpoints for indicators of compromise — from basic syntax to real-world...
- Project
TheHive: Self-Hosted Incident Response Case Management
Build a production-grade security incident response platform using TheHive 5, Cassandra, Elasticsearch, and MinIO — then integrate it with Wazuh alerts...
- HOWTO
Deploy OpenCanary to Catch Attackers Inside Your Network
Set up OpenCanary honeypot services on a Raspberry Pi or VM to detect lateral movement, credential stuffing, and unauthorized access before attackers...
- HOWTO
Sysmon and Windows Event Forwarding: Enterprise-Grade
Deploy Sysmon for deep process, network, and file telemetry, then centralise those events to a Windows Event Collector server using WEF — all without a...
- Project
Velociraptor DFIR: Endpoint Forensics and Incident Response
Deploy Velociraptor — the open-source DFIR platform — to collect forensic artifacts, run live endpoint hunts with VQL, and build an incident response...
- HOWTO
Network Traffic Analysis with Zeek: From Deployment to Threat Detection
Deploy Zeek (formerly Bro) on Linux to passively monitor network traffic, generate structured logs, write detection scripts, and forward data to your SIEM...
- Project
Deception Technology Lab: T-Pot Honeypot with OpenCanary
Deploy a full deception technology stack using T-Pot and OpenCanary to capture real attacker behaviour, generate threat intelligence, and sharpen your...