Blog Entries

21. 12. 2022 Damiano Chini Log Management, Log-SIEM, NetEye

How We Verify the Integrity of El Proxy Blockchains Altered by a Retention

El Proxy helps in compliance with GDPR regulations, which, besides the rest, imposes guarantees on the integrity of data and ensures that the data is kept for no longer than a predefined period of time. El Proxy ensures the integrity of the data by saving the data in El Proxy blockchains. The guarantee that data…

Read More
21. 12. 2022 Massimo Giaimo Blue Team, SEC4U

Protected: Some Insight into the Differences between AV and EDR

There is no excerpt because this is a protected post.

Read More
20. 12. 2022 Attilio Broglio NetEye

How to Parse HTML Email Messages with Tornado

Tornado is a CEP “Complex Event Processor” that receives reports of events from data sources such as monitoring and email, matches them against preconfigured rules, and executes the actions associated with those rules. Some vendors provide static notification systems that cannot be customized. For example, during one project we were faced with a tool that…

Read More
20. 12. 2022 Alessandro Valentini DevOps

One Year as a DevOps Engineer

The Beginning When I started my new role as a DevOps Engineer at the beginning of 2022, we had little experience in DevOps as a team. We tried several times to implement automation in order to simplify maintenance and reduce the amount of overall effort we invested in routine activities. However, since DevOps engineers are…

Read More
20. 12. 2022 Lorenzo Candeago Development, DevOps

A Simple and Portable Dockerfile for Working with Azure and Ansible

For our use case, we need to be able to deploy Azure machines using Ansible from developer’s laptops and from our own CI/CD infrastructure both on Jenkins and OpenShift. The easiest way to ship a working and easy-to-use environment for our use case is to create a Docker instance: we based our Docker on rockylinux…

Read More
20. 12. 2022 Massimo Giaimo Blue Team, SEC4U

Risepro: A New Infostealer Malware

The daily monitoring activities that we carry out within our Security Operation Center Attacker Centric have allowed us to identify the spread of a new infostealer type malware. Log (or information) stealer malware is a type of Trojan that gathers data in order to send it to the attacker. Typical targets are credentials saved in…

Read More
16. 12. 2022 Mattia Codato Bug Fixes, NetEye

Bug Fixes for NetEye 4.27

We fixed a bug that did not allow the RHEL version to be set correctly when the automatic subscription was disabled. For NetEye 4.27 we updated the following packages:

Read More
16. 12. 2022 Mattia Codato Bug Fixes, NetEye

NetEye 4 Core – Security Advisory

Synopsis Important: grafana-panel-renderer security update Type/Severity Security Advisory: Important Topic An update for the package grafana-panel-renderer is now available for NetEye 4. NetEye Product Security has rated this update as having a security impact of High. Common Vulnerability Scoring System (CVSS) base scores provide additional guidance about a vulnerability and give a detailed severity rating….

Read More
15. 12. 2022 Fabrizio Dovesi Service Management

Data-driven Models – the Ultimate Fighter Against a Company’s Complexity 👊 – Part 1 of 2

Guidelines for data-driven models for managing data complexity and designing robust systems that might be considered both a single-source-of-truth and a single-point-of-contact. In the last few decades the world has truly turned into a data jungle: digital evolutions expose people and companies to dealing with data complexity management, a topic which has rapidly turned into…

Read More
15. 12. 2022 Rocco Pezzani NetEye

Strategies for Secret Management

In my previous blog post, we had a long discussion about how Icinga 2 manages its configuration in a Distributed Monitoring environment and how this can lead to unwanted disclosure of sensitive data, be it Secrets or Personal Data. The post ended with a set of recommendations/best practices that can be summarized in the statement…

Read More
15. 12. 2022 Juergen Vigna NetEye

Migrate a NetEye 4 Server from CentOS 7 to RHEL 8 (v4.22->v4.23) with EFI Boot

When upgrading NetEye 4 from version 4.22 to version 4.23, the main focus is the upgrade/change of the operating system from CentOS 7 to the new RHEL 8 operating system. Normally you can proceed as explained in the Upgrade section of the user guide since NetEye 4 uses the “normal” BIOS boot sector with grub….

Read More
13. 12. 2022 Davide Sbetti Log-SIEM, Machine Learning

Building a Dashboard in Kibana to Keep Track of Your Smart Ingest Pipeline

In a previous article, we used NetEye and Elasticsearch to train a machine learning model able to classify documents about some collected radar signals, separating them into two categories (good vs bad), starting from an existing dataset. Afterwards, we applied it to new incoming documents using an Ingest Pipeline and the Inference Processor. Taking as…

Read More
13. 12. 2022 Damiano Chini Development, Log Management, Log-SIEM, NetEye

How We Sped up El Proxy Verification

Before deploying El Proxy in production we, the R&D Team, carried out numerous benchmarks and reproduced real life scenarios to ensure that the real-time log signing performed by El Proxy would not represent a bottleneck in environments where logs that must respect the Italian “Garante Privacy” regulations are generated with data rates of around 2,000…

Read More
12. 12. 2022 Mattia Codato NetEye, Unified Monitoring

ClickHouse – High Availability Cluster

As you have surely read from the release notes of NetEye 4.27, we have integrated ClickHouse to be able to use the historical flows and alerts feature of ntopng. What is ClickHouse? Directly from the official website: ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP). ClickHouse’s performance exceeds…

Read More
12. 12. 2022 Juergen Vigna NetEye, Unified Monitoring

Using More Than One SMS Gateway on a Server and Handling SMS Queues

Sending an SMS requires time, between 5-7 seconds. This means that if you have to write a lot of SMS’s, you have to attach more than one SMS gateway to your server to be able to send them within a certain time frame. This is possible using the USB connection of the SMS gateway. As…

Read More

Archive