Table of Contents¶
- Concepts
- Approaching Threat Hunting
- Declaration of Compromise
- Declaration of Policy Violation
- Detection and Event Enrichment Flow
- The Most Powerful Capabilities
- Stamus Security Platform
- Stamus Central Server
- Stamus Networks Probe
- Security Posture
- Compromises
- Analytics
- Beaconing
- Sightings
- Detection Methods
- Newly Registered Domains (NRD)
- Anatomy of a detection event
- Application layer
- Flow_id
- Flow section
- Metadata section (flowbits)
- FQDN breakdown for HTTP, TLS and DNS
- Tagging and Classification
- SMTP Enrichment
- Source and Target
- Organisational Context
- MAC address
- FQDN additions
- Discovery info
- GeoIP
- TLS Cipher analytics
- TLS JA4
- TLS ALPN
- DCERPC function name mappings
- Number of transactions in a flow
- SSH hassh, client and server software
- Additional resources
- Encryption
- Introduction / Setup
- Logs and detection
- Logs
- Detection
- NRD
- SIGHTINGS
- DNS over HTTPS (DoH)
- TOR detection
- HTTPS/TLS File Sharing Services
- Red-Listed Malicious TLS Communication
- Malicious TLS Communication Categories
- Cipher analytics
- JA4
- ALPN
- Available Dashboards and Visualizations
- Encryption Services Running on Hosts
- HTTPS Proxy
- Encrypted Transfers
- Suspicious Transfers
- Exfiltration
- Machine Learning-Enabled TLS Beaconing Detection
- Decryption
- Evidence
- Hunting
- Hunting Filters
- Kibana Dashboards
- Feature Request
- Administration
- Overview
- Authentication
- SCS settings
- Capture Settings
- Network Security Monitoring Settings
- Change NSM settings for a probe
- Enable or disable protocols for a probe
- Common settings for protocols
- Add custom or extended HTTP information
- Add custom or extended SMTP information
- Add custom DNS information
- Add packet data or payload to the alerts information
- File handling capabilities
- Enable or disable file extraction for a probe
- Add Hahsum, file magic or mimetype information
- Rule Activity for a probe
- Declarations of Compromise
- Declarations of Policy Violation
- Events Filtering
- File Extraction
- Conditional PCAP logging
- Global Configuration
- Network Definitions
- Probe Registration
- Probe Templates
- Stamus Loggers
- Run Your Own Defense (RYOD)
- Sources & Rulesets
- Splunk
- Suricata Sensors
- Threat Intelligence
- Webhooks
- External Links Templates
- Architectures
- Maintenance
- Licensing
- Preparing the Installation
- Installing Stamus Central Server
- Installing the Manager and the Network Probe
- Installing the Manager and the Network Probe using the OVF virtual images
- Installing the license
- Registering a Network Probe
- Management IP address
- Adding public sources (optional)
- Adding a Ruleset
- Attach the Ruleset to the Network Probe
- Update the ruleset
- Stamus Network Appliances
- USB Installation
- Backup & Restore
- Systems Upgrade
- Troubleshooting
- Monitoring
- Releases Notes
- Stamus Support
- Developer Corner
- Community