Introduction I attended many sessions at the “HP Protect 2012” conference last September and one of them – the “Plug it in!” by Doron Keller (HP/ArcSight) was very interesting for me. As a former software developer, I always like any possibilities of enriching features of an existing product by writing few lines of code. Furthermore … Read more
The “Replay” (also known as Test Alert) agent at the ESM ArcSight – is a very powerful tool for developing and debugging rules. You don’t need to wait until a real (and probably rare!) event will be received by the ESM Manager only to check that the rule produced incorrect result. Of course a test … Read more
Last weekend a friend of mine told me about some issue with her new laptop: suddenly IE’s home page was set to Desjardins (https://accesd.desjardins.com/). Well, nothing wrong, it is a legitimate web site except one thing that she was not able to change it! I agreed to take a look and asked to run the … Read more
Today I suddenly revealed that last year USPTO approved the patent application that was filed a long time ago. The patent “System and method of data security in synchronizing data with a wireless device” was filed when I used to work for the “PDA Defense” project. The company “Good technology, Inc” is current assignee. I … Read more
Today I got an automatic email from Twitter: Hi, alexvirt1 Twitter believes that your account may have been compromised by a website or service not associated with Twitter. We’ve reset your password to prevent others from accessing your account. You’ll need to create a new password for your Twitter account. You can select a … Read more
Everybody knows that MacOS is “virus-proof”. In reality, of course – not. It appears that everybody who tries to prove the truth may be punished: Apple Snubs Firm That Discovered Mac Botnet, Tries To Cut Off Its Server Monitoring Infections Boris Sharov, chief executive of the Moscow-based security Dr. Web says he learned Monday from … Read more
Oh no! Today I again experienced this weird X11 error: when I try to launch a GUI from a Linux CLI, instead of a beautiful (actually not) window I saw this error message: Xlib: connection to “localhost:10.0” refused by server Xlib: PuTTY X11 proxy: MIT-MAGIC-COOKIE-1 data did not match Error: Can’t open display: localhost:10 Well, … Read more
I wrote a small introduction article about log monitoring and how it relates to advanced threats detection. Why using of SIEM is important. Read the article.