Evidence · Playbooks

Playbooks

One investigation question, answered in Splunk, Microsoft Sentinel and Wazuh on the same day of honeypot data. Every query here was run and its result checked against the others.

• Downloaded files, and whether they were run

  Which files did attackers download, from how many sources, and in how many of those sessions did they then try to run something?

  Splunk Microsoft Sentinel T1105 T1059.004

• Which credentials got attackers in

  Which username and password pairs logged in successfully, how often, and from how many sources?

  Splunk Microsoft Sentinel Wazuh T1078 T1110.001

• Persistence attempts after login

  Which sources tried to plant an SSH key or a cron job, and how often?

  Splunk Microsoft Sentinel Wazuh T1098.004 T1053.003

• Network alert first, then a login

  Which sources triggered a Suricata alert and later logged in to the honeypot?

  Splunk Microsoft Sentinel Wazuh T1595 T1110 T1078

• What the IDS is alerting on

  Which Suricata signatures fired, how often, and from how many sources?

  Splunk Microsoft Sentinel Wazuh T1595 T1190