#Security
All CosmicBytez Labs articles tagged #Security, across news, security advisories, how-to guides, and projects.
- News
Signal Adds Automatic Key Verification to Thwart Man-in-the-Middle Attacks
Signal launched Automatic Key Verification on August 12, 2026, using key transparency audited by Cloudflare and Trail of Bits to defeat MITM attacks.
- Project
Step-CA: Build a Private Certificate Authority for Your Homelab
Stop accepting self-signed certificate warnings. Deploy Smallstep's step-ca as a fully automated internal PKI — complete with ACME support, Traefik...
- HOWTO
What Is SentinelAgent.exe? SentinelOne's Agent Process
SentinelAgent.exe is the core SentinelOne EDR agent process on Windows. How to verify it is genuine, what drives its resource usage, and how to manage it.
- HOWTO
WireGuard VPN: Secure Remote Access for IT Professionals
Deploy a modern, high-performance WireGuard VPN server on Linux for secure remote access. Covers server setup, client configuration, multi-peer...
- HOWTO
Lynis: Linux Security Auditing and Hardening in Practice
Learn how to use Lynis to audit, score, and harden Linux systems. Covers installation, scan interpretation, automated reporting, and CI integration for...
- Project
OpenCTI: Building a Cyber Threat Intelligence Platform in Your Homelab
Deploy OpenCTI to aggregate, correlate, and visualize threat intelligence from MISP, NVD, AlienVault OTX, and Shodan — all in a self-hosted Docker stack.
- News
NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks
NPM 12 will disable dependency install scripts by default, requiring explicit opt-in—a major shift targeting the supply chain attack vector exploited...
- Project
Teleport PAM: Zero-Trust Privileged Access for Your Homelab
Deploy Teleport's open-source privileged access management platform to replace static SSH keys with short-lived certificates, enforce MFA, record every...
- Project
Building a Wazuh XDR + SIEM Homelab
Deploy a full Wazuh stack in Docker to gain host-based intrusion detection, file integrity monitoring, vulnerability scanning, and active response across your…
- Project
Runtime Security Monitoring with Falco: Detect Container
Deploy Falco on a Docker host to monitor container syscalls at the kernel level, write custom homelab detection rules, and route real-time alerts through.
- News
npm Adds 2FA-Gated Publishing and Package Install Controls
GitHub has rolled out new security controls for npm including staged publishing with 2FA approval requirements and package install policies, giving...
- News
Apple Blocked Over $11 Billion in App Store Fraud in 6 Years
Apple has revealed it blocked more than $11 billion in fraudulent App Store transactions over the past six years, including $2.2 billion in 2025 alone,...
- News
Apple Rejected 2 Million App Store Submissions in 2025 for Security and Fraud Prevention
Apple's annual transparency report reveals the company blocked over 2 million App Store submissions, 1.1 billion accounts, and $2.2 billion in potentially...
- HOWTO
CrowdSec: Deploy a Community-Powered Intrusion Prevention System
Install and configure CrowdSec on Linux to detect and block attacks using crowdsourced threat intelligence, custom scenarios, and iptables/nftables bouncers.
- Project
Self-Hosted Password Manager with Vaultwarden
Deploy a fully self-hosted, Bitwarden-compatible password manager using Vaultwarden on Docker with Caddy reverse proxy, automatic TLS, WebSocket...
- Project
WireGuard Road Warrior VPN Server
Build a self-hosted WireGuard VPN server on Ubuntu for secure remote access — with NAT masquerading, DNS leak protection, QR-code client provisioning, and...
- HOWTO
Container Security Scanning with Trivy: Images, IaC, and CI/CD
Learn how to use Trivy to scan container images, Dockerfiles, Kubernetes manifests, and Terraform for vulnerabilities and misconfigurations — then...
- Project
Build a Collaborative IPS with CrowdSec
Deploy CrowdSec on a Linux server to get community-powered intrusion prevention — block brute-force attacks, credential stuffing, and vulnerability...
- Project
Keycloak SSO: Self-Hosted Identity Provider for Your Homelab
Deploy Keycloak with Docker Compose and PostgreSQL to build a centralised single sign-on platform for your homelab services, with OIDC integration for...
- HOWTO
Domain Controller Hardening: Securing Active Directory
Comprehensive DC hardening guide covering tier model implementation, LDAP signing, NTLM restrictions, Kerberos hardening, AdminSDHolder, DSRM security,...
- HOWTO
Windows Server Hardening: A Complete Security Guide for Enterprises
Step-by-step Windows Server hardening covering CIS benchmarks, attack surface reduction, service hardening, firewall rules, credential protection, and...
- Checklist
IT Employee Offboarding Checklist
Complete IT offboarding checklist for departing employees. Covers account deactivation, access revocation, device recovery, data management, and...
- HOWTO
SentinelOne Application Control Policies
Organizations face security risks from unauthorized applications, malware disguised as legitimate software, and shadow IT installations that bypass...
- HOWTO
SentinelOne Control vs Complete Feature Comparison
This document provides a comprehensive comparison between SentinelOne Singularity Control and Singularity Complete SKUs to help MSP teams understand the...
- HOWTO
SentinelOne Create and Manage Exclusion Policies
SentinelOne exclusion policies allow security teams to prevent false-positive detections and performance issues by excluding specific files, folders,...
- HOWTO
SentinelOne Data Retention and Storage Management
Organizations using SentinelOne Singularity Complete receive 14-365+ days of Deep Visibility EDR data retention by default. This historical telemetry...
- HOWTO
SentinelOne Deep Visibility Threat Hunting
Deep Visibility is SentinelOne's EDR telemetry engine that provides comprehensive endpoint data collection for threat hunting, incident investigation, and...
- HOWTO
SentinelOne Deploy Agent Manual Installation
Manual SentinelOne agent installation is used when automated deployment methods (GPO, RMM, SCCM) are unavailable or when installing on standalone...
- HOWTO
SentinelOne Deploy Agent via Group Policy
Deploying SentinelOne agents across Windows endpoints at scale using Active Directory Group Policy Objects (GPO) enables centralized, automated agent...
- HOWTO
Deploy SentinelOne Policy
Deploy, manage, and validate SentinelOne security policies across your endpoint estate using the SentinelOne Management API. This automated workflow supports:
- HOWTO
SentinelOne Device Control: Block USB & Bluetooth Devices
How to block USB drives and Bluetooth peripherals with SentinelOne Device Control — audit in Monitor mode, then enforce allow/block policies safely.
- HOWTO
SentinelOne File Fetch and Forensic File Collection
During threat investigations, security analysts need to retrieve suspicious files from endpoints for deeper forensic analysis. Traditional methods...
- HOWTO
SentinelOne Firewall Control Management
Traditional endpoint protection focuses on file-based malware, but network-based attacks (lateral movement, command-and-control callbacks, port scanning,...
- HOWTO
SentinelOne Forensics Rollback and Remediation
This document provides comprehensive procedures for forensic evidence collection, ransomware rollback, and threat remediation using SentinelOne Complete...
- HOWTO
SentinelOne Health Check: Agent Status Monitoring Guide
Organizations deploying SentinelOne endpoint protection require continuous monitoring of agent health to ensure comprehensive threat coverage across their...
- HOWTO
Invoke SentinelOne Threat Hunt
Proactive threat hunting is essential for identifying sophisticated threats that evade automated detection systems. This script automates the process of...
- HOWTO
SentinelOne MITRE ATT&CK Threat Hunting
The MITRE ATT&CK framework catalogs 14 tactics and 200+ techniques used by adversaries. Security teams need to proactively hunt for these techniques in...
- HOWTO
SentinelOne MSP Client Onboarding
This runbook provides a standardized process for onboarding new MSP clients to SentinelOne Singularity Complete. Following this methodology ensures...
- HOWTO
SentinelOne Policy Configuration Best Practices
This guide provides comprehensive best practices for configuring SentinelOne policies in MSP environments managing multiple client sites with Singularity...
- HOWTO
SentinelOne PowerShell API Automation
The SentinelOne Management Console REST API enables automation of administrative tasks, reporting, threat response, and integration with existing security...
- HOWTO
SentinelOne PowerShell Automation Scripts
This document provides a comprehensive library of production-ready PowerShell scripts for automating SentinelOne operations in an MSP environment. These...
- HOWTO
SentinelOne Purple AI Usage Guide
Security Operations Centers (SOCs) face overwhelming alert volumes, complex threat investigations, and resource constraints. Analysts spend hours writing...
- HOWTO
SentinelOne Ranger Network Discovery and IoT Visibility
Modern enterprise networks contain a complex mix of managed endpoints (workstations, servers), IoT devices (IP cameras, printers, smart building systems),...
- HOWTO
SentinelOne Remote Shell Operations
Full Remote Shell is a SentinelOne Complete feature that provides authorized administrators with secure, native command-line access to managed endpoints...
- HOWTO
SentinelOne RMM Integration Guide
This runbook provides comprehensive guidance for integrating SentinelOne Singularity Complete with NinjaRMM and other RMM platforms. Proper RMM...
- HOWTO
SentinelOne Sandbox Integration Configuration
SentinelOne detects suspicious files but automated malware analysis requires sandbox integration. Manually uploading files to VirusTotal, Joe Sandbox, or...
- HOWTO
SentinelOne STAR Advanced Automation and Watchlists
Security teams face the challenge of detecting organization-specific threats, insider threats, and policy violations that generic detection rules cannot...
- HOWTO
SentinelOne STAR Custom Detection Rules
Storyline Active Response (STAR) is SentinelOne's cloud-based automated hunting, detection, and response engine that allows security teams to create...
- HOWTO
SentinelOne Threat Investigation Workflow
When SentinelOne detects a threat on an endpoint, security analysts must quickly investigate the alert to determine if it's a genuine malware infection,...
- HOWTO
SentinelOne Timeline Forensics and Attack Chain Analysis
Understanding the complete attack chain requires correlating hundreds of events (process creation, network connections, file modifications, registry...
- Checklist
IT Employee Onboarding Checklist
Complete IT onboarding checklist for new employee setup. Covers account provisioning, hardware deployment, security configuration, software installation,...
- Checklist
Server Hardening Security Checklist
Comprehensive checklist for hardening Linux and Windows servers before production deployment. Covers OS configuration, network security, access controls,...
- Checklist
Incident Response Checklist
Step-by-step incident response checklist following NIST SP 800-61 framework. Covers preparation, detection, containment, eradication, recovery, and...
- News
Samsung Ends Software Support for Galaxy S21 Series
Samsung's February 2026 update roadmap removes Galaxy S21 lineup from support, while S22 series moves to quarterly updates.
- HOWTO
Microsoft 365 Security and Compliance Configuration Guide
Harden your Microsoft 365 tenant with security baselines, conditional access policies, data loss prevention, audit logging, and compliance configurations...
- HOWTO
Conditional Access Policies: Zero Trust with Entra ID
Implement Zero Trust security with Microsoft Entra ID Conditional Access. Covers named locations, device compliance, risk-based policies, and...
- HOWTO
Enterprise BitLocker Automation with PowerShell
Deploy and manage BitLocker encryption at scale using PowerShell, with automatic TPM validation, recovery key backup to Azure AD and NinjaRMM, and...
- HOWTO
FortiGate Firewall Policy Management with PowerShell
Automate FortiGate firewall policy creation, backup, and auditing using PowerShell and the FortiOS REST API. Includes bulk rule deployment, change...
- HOWTO
Kubernetes Secrets Management with External Secrets Operator
Securely manage Kubernetes secrets using External Secrets Operator. Covers ESO installation, SecretStore configuration, syncing from Azure Key Vault and...
- HOWTO
SentinelOne Agent Deployment: EDR Installation Guide
Deploy and manage SentinelOne EDR agents across your environment. Covers manual installation, verification, troubleshooting, and best practices.
- HOWTO
SentinelOne Threat Hunting Recipes: Practical Deep
A practical recipe book of Deep Visibility hunts — encoded PowerShell, LOLBin abuse, lateral movement, persistence mechanisms. Each recipe is a copy-paste S1QL.
- Project
Azure Landing Zone with Terraform
Deploy enterprise-ready Azure environment with hub-spoke network, Azure Firewall, Log Analytics, Defender for Cloud following Microsoft CAF best practices.
- Project
CI/CD Pipeline with GitHub Actions and Azure
Build a secure CI/CD pipeline with GitHub Actions deploying to Azure. Covers build, test, security scanning (SAST/DAST), and deployment with OIDC...
- Newsletter
Security Roundup & FortiGate Deep Dive - Issue #2
This week: FortiGate SD-WAN deployment, new CVEs affecting critical infrastructure, and Azure Sentinel implementation tips.
- HOWTO
Building a Secure Homelab in 2026: Complete Guide
Learn how to set up a production-grade homelab with proper network segmentation, monitoring, and security controls. Perfect for IT professionals and...
- HOWTO
SSH Hardening Best Practices
Secure your SSH servers with essential hardening techniques including key-based authentication, fail2ban configuration, and advanced security measures.
- HOWTO
WireGuard VPN Setup and Security Hardening on Linux
Deploy a hardened WireGuard VPN server on Linux — key generation, server and client config, firewall rules, and security best practices for production use.
- Newsletter
Welcome to CosmicBytez Labs - Issue #1
Welcome to the first issue of the CosmicBytez Labs newsletter! This week: major security vulnerabilities, Kubernetes best practices, and cloud...
- HOWTO
Linux Server Hardening: Complete Security Checklist
Comprehensive guide to hardening Linux servers covering user management, service configuration, kernel security, and ongoing maintenance for production systems.
- HOWTO
Docker Security Fundamentals: Protecting Your Containers
Learn essential Docker security practices including image scanning, runtime protection, network isolation, and secrets management for production environments.
- HOWTO
Windows Security Baseline Audit: CIS Benchmark Compliance
Automate Windows security baseline checks using PowerShell. Validate configurations against CIS benchmarks for password policies, audit settings, and...
- HOWTO
Windows Security Event Log Analysis: Detect Threats with PowerShell
Learn to analyze Windows Security Event Logs to detect brute force attacks, lateral movement, privilege escalation, and other security threats using PowerShell.
- HOWTO
Pi-hole DNS Security: Block Ads, Trackers, and Malware
Deploy Pi-hole for network-wide ad blocking and DNS security. Includes setup, configuration, upstream DNS options, and integration with encrypted DNS.
- HOWTO
Implementing a Robust Backup Strategy: The 3-2-1 Rule
Design and implement a comprehensive backup strategy using the 3-2-1 rule. Covers backup types, automation, encryption, and disaster recovery testing.
- Project
Build a Centralized Log Management System with Loki and Grafana
Deploy a scalable log management solution using Grafana Loki. Learn to aggregate, search, and alert on logs from your entire infrastructure.
- HOWTO
Network Monitoring Basics: Detect Threats Before They Spread
Learn how to set up effective network monitoring using open-source tools. Covers traffic analysis, alerting, and common indicators of compromise.
- HOWTO
Self-Hosting a Password Manager: Vaultwarden Setup Guide
Deploy your own password manager with Vaultwarden (Bitwarden-compatible). Includes secure configuration, SSL setup, and backup procedures.