Hands on with Charlie Lima! SIEM : Detection & Response : Automation
For this specifics lab, we worked with a Windows 10 System with all defenses disabled to setup a sufficient attack surface (Victim ). We then built an addition VM with Linux and utilized the system as the Attack point (Attacker). We utilized Sliver, a C2 framework to throw attacks at the victim system and used Charlie Lima to detect and respond to each incident. Afterwards we deep dived into the SIEM and DNR ruleset to make some adjustments. We had a blast learning how to remove false-positives to ensure our response and defense actions were effective!