#SIEM and Log Management

#Wazuh (Open-Source SIEM/XDR)

Three components:

• Wazuh Indexer (OpenSearch-based)
• Wazuh Server (decoder/rule engine)
• Wazuh Dashboard (web UI)

Capabilities: log analytics, intrusion detection, FIM, configuration assessment, vulnerability detection, compliance.

Collects via agents (logs, system activity, file changes) and agentless (Syslog/SSH/APIs).

• Platform: https://wazuh.com/platform/siem/
• Threat hunting: https://documentation.wazuh.com/current/getting-started/use-cases/threat-hunting.html
• Guide: https://medium.com/@sadashivpole/wazuh-complete-guide-to-hids-siem-and-enterprise-threat-detection-120d376bfbc0
• Deploy 2025: https://www.onlinehashcrack.com/guides/tutorials/howto-deploy-wazuh-siem-2025-monitor-hosts.php

#Volatility Memory Forensics

V3 replaced V2. Supports Windows, Linux, macOS memory dumps. Detects fileless malware, kernel rootkits, process injection, in-memory C2.

Workflow: process triage (pstree, psscan) -> network triage (netscan) -> suspicious process analysis (dlllist, malfind) -> command history (cmdline, linux.bash)

• Guide: https://www.cyberforensicacademy.com/blog/volatility-framework-complete-memory-forensics-guide
• Cheat sheet: https://medium.com/@0x0Aleem/practical-memory-forensics-with-volatility-2-3-windows-and-linux-cheat-sheet-ef5eee325863

#Container Security Scanning

#Trivy

Comprehensive: vulnerabilities, misconfigs, secrets, SBOM generation. Broader scope, slightly slower.

#Grype

Focused vuln scanner, 30-40% faster than Trivy. Pairs with Syft for SBOM.

Both produce false positives/negatives. Do not treat as authoritative alone.

• Grype: https://github.com/anchore/grype
• Comparison: https://www.stakater.com/post/open-source-container-security-a-deep-dive-into-trivy-clair-and-grype

#Supply Chain

• SLSA Framework: four levels of build integrity assurance
• Reproducible builds: https://reproducible-builds.org/
• SBOM to SLSA guide: https://petronellatech.com/blog/from-sbom-to-slsa-securing-your-software-supply-chain/