Skip to main content

Integrating McAfee SIEM with Apache Nifi Video 3/3

In this last video, I show how to create a parser for the SIEM to be able to understand the information received, and how to disable aggregation so each twitter message generates and unique event.

This is a good way to maintain a continuous flow of events specially interested when performance is measured.


Labels:

Comments

  1. AnonymousApril 4, 2022 at 6:54 PM

    Mysuru Casino - The HERZAMMAN
    Mysuru Casino - 바카라 The Home of the Best of the Slots! Visit us to https://vannienailor4166blog.blogspot.com/ Play the ventureberg.com/ best nba매니아 slots poormansguidetocasinogambling and enjoy the best table games in our casino. Visit us

    ReplyDelete
  2. barikababinNovember 7, 2022 at 6:26 AM

    "Train the croupiers to spin the ball after they launch it, and make sure that|be positive that|ensure that} the tables are level and the air-con is working," Small mentioned, to permit for any influence of air resistance. The examine suggests strategies for each side of the roulette wheel. The concept of using scientific understanding to beat the house isn’t new. In the late Nineteen Seventies the "Eudaemons," a bunch of physics postgraduates, used theoretical insights and a rudimentary pc hid in a shoe to win 영앤리치 토토 at roulette in Nevada in the Nineteen Seventies. But since they didn’t publish their research, no one exterior their staff is aware of} primary points} of how they did it. "We extrapolate that prediction to the purpose where the ball hits one of many deflectors -- the raised bumps in the wheel's rim which might be} added to increase the random bouncing of the ball," Small defined.

    ReplyDelete

Post a Comment

Popular posts from this blog

Working with McAfee SIEM API

McAfee SIEM has a strong API that allows to interact with the application programatically. This API offers a RESTful interface and its documentation is available in the following URL on a running ESM https://<ESM_IP>/rs/esm/help In this post, through a set of code snippets I will show you how to connect to the ESM API via RESTful and execute different API commands. 1) Initial connection to the API Server In this first code snippet we are authenticating against the API and we obtain a token in the response that we use in order to create an authenticated header that will be used for the rest of API connections. 2) Testing that we have all the authentication parameters needed. Getting the time of the system. In this second code snippet we use the just obtained authentication header in order to get the system time through the available command (essmgtGetESSTime)   3) Getting the version (builtstamp) of the system.   4) Other useful available ...
2 comments
Read more

How to blacklist IPs on McAfee Network Security Platform

Python script that allows to blacklist IPs on McAfee Network Security Platform. The uses is quite straightforward, bellow you can see some examples Usage nsmcli.py [-h] -u USER -p PASSWORD -nsm NSM_IP [-get_sensors][-get_qhosts][-sensor SENSOR_NAME][-i IP_ADDRESS][-quarantine][-remove] [-t {15,30,45,60,240,480,720,960,999}][--version] Examples of usage Get the list of sensors managed by a Network Security Manager nsmcli.py -u admin -p admin123 -nsm 192.168.0.202 -get_sensors Name ID           Model   Sensor     IP                     SW Ver    Sigset Ver   Active M2750-4pocs   1001     M-2750   192.168.0.203   7.5.3.16   7.6.14.9       1 Get the list of quarantine IPs nsmcli.py -u admin -p admin123 -nsm 192.168.0.202 -get_qhosts Quarantined hosts for M2750-4pocs ...
1 comment
Read more

Demonstrating Wannacry kill switch with McAfee Active Response

In this video, you can see the how Wannacry works, specifically the killswitch. Basically a system affected by Wannacry tries to connect to the killswitch link, if it does the infection stops and the system does't get infected or the malware propagated. During the video  I modified the killswith to point to localhost in order to demonstrate how the systems reacts when the killswitch server is not available. The solution used during this video is McAfee Active Response (MAR), this solution is McAfee Endpoint Detection and Response (EDR) able to trace the activity done by the endpoint when a suspicious file is executed.  McAfee Active Response uses Open Data Exchange Layer (DxL) to share endpoint trace information and execute live search queries.
Post a Comment
Read more