Skip to content

Commit

Permalink
Merge pull request #1275 from Yamato-Security/update-results-pic
Browse files Browse the repository at this point in the history
Updated Results.png pic
  • Loading branch information
YamatoSecurity authored Feb 11, 2024
2 parents 766fbb1 + 56f8a66 commit 6779465
Show file tree
Hide file tree
Showing 4 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion README-Japanese.md
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@ Hayabusaは、日本の[Yamato Security](https://yamatosecurity.connpass.com/)

### スレット(脅威)ハンティングと企業向けの広範囲なDFIR

Hayabusaには現在、2500以上のSigmaルールと150以上のHayabusa検知ルールがあり、定期的にルールが追加されています。
Hayabusaには現在、4000以上のSigmaルールと170以上のHayabusa検知ルールがあり、定期的にルールが追加されています。
[Velociraptor](https://docs.velociraptor.app/)[Hayabusa artifact](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.hayabusa/)を用いることで企業向けの広範囲なスレットハンティングだけでなくDFIR(デジタルフォレンジックとインシデントレスポンス)にも無料で利用することが可能です。
この2つのオープンソースを組み合わせることで、SIEMが設定されていない環境でも実質的に遡及してSIEMを再現することができます。
具体的な方法は[Eric Capuano](https://twitter.com/eric_capuano)[こちら](https://www.youtube.com/watch?v=Q1IoGX--814)の動画で学ぶことができます。
Expand Down
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@ Hayabusa is a **Windows event log fast forensics timeline generator** and **thre

### Threat Hunting and Enterprise-wide DFIR

Hayabusa currently has over 2500 Sigma rules and over 150 Hayabusa built-in detection rules with more rules being added regularly.
Hayabusa currently has over 4000 Sigma rules and over 170 Hayabusa built-in detection rules with more rules being added regularly.
It can be used for enterprise-wide proactive threat hunting as well as DFIR (Digital Forensics and Incident Response) for free with [Velociraptor](https://docs.velociraptor.app/)'s [Hayabusa artifact](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.hayabusa/).
By combining these two open-source tools, you can essentially retroactively reproduce a SIEM when there is no SIEM setup in the environment.
You can learn about how to do this by watching [Eric Capuano](https://twitter.com/eric_capuano)'s Velociraptor walkthrough [here](https://www.youtube.com/watch?v=Q1IoGX--814).
Expand Down
2 changes: 1 addition & 1 deletion rules
Submodule rules updated 3870 files
Binary file modified screenshots/Results.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit 6779465

Please sign in to comment.