diff --git a/.github/vale/.vale.ini b/.github/vale/.vale.ini new file mode 100644 index 0000000..b115674 --- /dev/null +++ b/.github/vale/.vale.ini @@ -0,0 +1,9 @@ +StylesPath = .github/vale/styles +MinAlertLevel = suggestion + +Vocab = Base + +Packages = write-good + +[*.md] +BasedOnStyles = Vale, write-good diff --git a/.github/vale/styles/Vocab/Base/accept.txt b/.github/vale/styles/Vocab/Base/accept.txt new file mode 100644 index 0000000..e69de29 diff --git a/.github/vale/styles/Vocab/Base/reject.txt b/.github/vale/styles/Vocab/Base/reject.txt new file mode 100644 index 0000000..e69de29 diff --git a/.github/workflows/vale.yml b/.github/workflows/vale.yml new file mode 100644 index 0000000..cf1a13c --- /dev/null +++ b/.github/workflows/vale.yml @@ -0,0 +1,22 @@ +name: reviewdog + +on: [pull_request] + +jobs: + prose: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + - name: Install and run Vale + uses: errata-ai/vale-action@reviewdog + env: + GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} + with: + version: 2.29.0 + vale_flags: --config=${{github.workspace}}/.github/vale/.vale.ini + reporter: github-pr-check + fail_on_error: true + filter_mode: added + files: all + diff --git a/2023-05-26-elastic-cybersecurity.md b/2023-05-26-elastic-cybersecurity.md new file mode 100644 index 0000000..ca3a2ce --- /dev/null +++ b/2023-05-26-elastic-cybersecurity.md @@ -0,0 +1,27 @@ +--- +layout: post +comments: true +title: Elasticsearch use cases in cybersecurity +excerpt: Learn about the difference use cases for Elasticsearch in a cybersecurity context +tags: [elasticsearch,cybersecurity] +toc: true +img_excerpt: +--- + + five main stages in the vulnerability management cycle +
+ + +- Data centralization: Elasticsearch provides a centralized repository for storing vulnerability data from disparate sources like threat intelligence feeds, asset inventory lists, application and system audits, and penetration testing reports. By consolidating this data, security operations teams can obtain an overarching view of their organization's vulnerabilities and prioritize remediation efforts accordingly. +- Automatic parsing: As soon as new vulnerabilities are discovered or updated, they must go through manual triage, which requires extensive human effort and often leads to delays. Elasticsearch can automatically parse vulnerability data streams from various sources (e.g., CVE, NVD, OSVDB, MITRE ATT&CK) to extract necessary contextual attributes. Then, it assigns scores or severity ratings based on predefined rules tailored to each organization's unique environment. +- Enhanced visibility: Elasticsearch indexes vulnerability records, allowing users to perform full-text queries, faceted navigation, and sorting. This capability provides enhanced visibility into the types, origins, and impact levels of the identified vulnerabilities, empowering administrators to focus attention on problem areas more precisely. +- Adaptive workflow orchestration: Integration with Elasticsearch enables orchestration tools like open-source OSBase, Demisto, and Phantom Cyber to dynamically adjust their workstreams based on the current state of known vulnerabilities. This adaptive approach ensures that security practitioners always tackle high-priority weaknesses first while minimizing resource wastage on already-resolved issues. +- Personalized notifications: Leveraging machine learning algorithms, Elasticsearch can assist in generating personalized notification strategies b + + +- https://github.com/DSecureMe/vmc +- https://github.com/opencve/opencve + + +## That's all folks +I hope you enjoyed this article, feel free to leave a comment or reach out on twitter [@bachiirc](https://twitter.com/bachiirc). diff --git a/_config.yml b/_config.yml index 7be39e8..29e7a19 100644 --- a/_config.yml +++ b/_config.yml @@ -19,7 +19,7 @@ author: paginate: 10 -google_analytics: UA-128961990-1 +google_analytics: G-4WZPY3NXS7 # Custom vars version: 2.1.0 diff --git a/_includes/analytics.html b/_includes/analytics.html index c8e6296..ffcfacd 100644 --- a/_includes/analytics.html +++ b/_includes/analytics.html @@ -1,5 +1,5 @@ - + + + + + log files queueerrors queueDashboardLogsVPCVPCVPCS3 BucketAd-hoc searchingest logselasticsearchclusterfailuresS3 notificationtriggerVPC flow logsVPC flow logsVPC flow logsother log filessearch \ No newline at end of file diff --git a/assets/2023/04/2023-04-17-network-observability-elastic-architecture-gcp.svg b/assets/2023/04/2023-04-17-network-observability-elastic-architecture-gcp.svg new file mode 100644 index 0000000..d70268e --- /dev/null +++ b/assets/2023/04/2023-04-17-network-observability-elastic-architecture-gcp.svg @@ -0,0 +1,17 @@ + + + + + + + + DashboardLogsAd-hoc searchingest logselasticsearchclusterfailuresnotificationtriggerVPC flow logsother log filessearchPubSubDead-Letter QueueCloud StorageCloud FunctionsPubSublog files queueVPCVPCVPCretry \ No newline at end of file diff --git a/assets/2023/04/2023-04-25-elastic-security-architecture.svg b/assets/2023/04/2023-04-25-elastic-security-architecture.svg new file mode 100644 index 0000000..223bd04 --- /dev/null +++ b/assets/2023/04/2023-04-25-elastic-security-architecture.svg @@ -0,0 +1,17 @@ + + + + + + + + DashboardsearchelasticsearchclustersearchElastic AgentIngestion PipelineauditfilemetricpacketConnectorsDetection RulesAnomaly JobsAlerts \ No newline at end of file diff --git a/assets/2023/07/2023-07-20-vertex-ai.svg b/assets/2023/07/2023-07-20-vertex-ai.svg new file mode 100644 index 0000000..c39ae38 --- /dev/null +++ b/assets/2023/07/2023-07-20-vertex-ai.svg @@ -0,0 +1,17 @@ + + + + + + + + Model GardenGenerative AI StudioOpen SourcemodelsTask-specific AutoML & APIsFoundationmodelsPrompt DesignPrompt TuningFine TuningML PlatformData Science toolkitNotebooks + integration with data servicesFully-managed tools, workflowsand infrastructureEnd-to-End ML Ops \ No newline at end of file diff --git a/assets/2023/07/2023-07-30-genai-lifecycle.svg b/assets/2023/07/2023-07-30-genai-lifecycle.svg new file mode 100644 index 0000000..9c313b6 --- /dev/null +++ b/assets/2023/07/2023-07-30-genai-lifecycle.svg @@ -0,0 +1,17 @@ + + + + + + + + ScopeDefine the use caseChoose an existing model or pretrain your ownSelectEvaluateAdapt and align modelPrompt engineeringFine tuningAlign with human feedbackApplication integrationOptimize and deploymodel for inferenceAugment model and build LLM- powered applications \ No newline at end of file diff --git a/assets/2023/08/20230807-serverless-meeting-minutes-architecture-gcp.svg b/assets/2023/08/20230807-serverless-meeting-minutes-architecture-gcp.svg new file mode 100644 index 0000000..330e672 --- /dev/null +++ b/assets/2023/08/20230807-serverless-meeting-minutes-architecture-gcp.svg @@ -0,0 +1,17 @@ + + + + + + + + export transcriptfailuresnotificationtriggerDead-Letter QueueCloud StorageCloud FunctionsPubSubretryAudio filesqueueCloud StorageSpeech to textVertex AI \ No newline at end of file diff --git a/assets/2023/08/20230820-gcp-huggingface.svg b/assets/2023/08/20230820-gcp-huggingface.svg new file mode 100644 index 0000000..fbed8f3 --- /dev/null +++ b/assets/2023/08/20230820-gcp-huggingface.svg @@ -0,0 +1,17 @@ + + + + + + + + Cloud RunArtifact Registrytext generationrequestCloud StorageCloud Storage FUSEpublishimageHugging Face HubDevdownload model weightsmount/data \ No newline at end of file diff --git a/assets/2023/09/20230901-palm-recommendation.svg b/assets/2023/09/20230901-palm-recommendation.svg new file mode 100644 index 0000000..ef96ea5 --- /dev/null +++ b/assets/2023/09/20230901-palm-recommendation.svg @@ -0,0 +1,17 @@ + + + + + + + + parseembedextracttagsArticles datasetupload enriched articlePaLM UserknnsearchembedrecommendedartcilesArticle \ No newline at end of file diff --git a/assets/2023/09/20230922-palm-synthetic-data.svg b/assets/2023/09/20230922-palm-synthetic-data.svg new file mode 100644 index 0000000..a6760c7 --- /dev/null +++ b/assets/2023/09/20230922-palm-synthetic-data.svg @@ -0,0 +1,17 @@ + + + + + + + + UserQuery + PromptInformationQueryKnowledgesource123Prompt + Chunk5SyntheticDataTextChunking46AppPaLM \ No newline at end of file diff --git a/assets/2023/10/20231001-gcp-serverless-rag.svg b/assets/2023/10/20231001-gcp-serverless-rag.svg new file mode 100644 index 0000000..b5444e2 --- /dev/null +++ b/assets/2023/10/20231001-gcp-serverless-rag.svg @@ -0,0 +1,17 @@ + + + + + + + + Cloud StorageCloud FunctionsPubSubCloud SQLVertex AICloud RunUser1uploaddocumentnotification2trigger3Documentprocessingchunking45embed chunk6Save documentwith embeddingsQuery78embed queryResult10Search withembeddings9 \ No newline at end of file diff --git a/assets/logos/elastic-beats-logo-vector.svg b/assets/logos/elastic-beats-logo-vector.svg new file mode 100644 index 0000000..6ff823d --- /dev/null +++ b/assets/logos/elastic-beats-logo-vector.svg @@ -0,0 +1 @@ + diff --git a/assets/logos/scala-full-color.svg b/assets/logos/scala-full-color.svg new file mode 100644 index 0000000..da21d14 --- /dev/null +++ b/assets/logos/scala-full-color.svg @@ -0,0 +1 @@ +scala-full-color \ No newline at end of file