Investigating Active Directory Account Lockouts Like an Analyst
Yeah so account lockouts. Most of them are boring. Phone still has the old password, Outlook on a laptop that never got the new one, some backup job …
Continue reading →Searching Cisco ASA Logs using Grep
Get all Login/Logoff events (113039 = Login, 113019 = Disconnect/Logoff) cat asa_logs.csv | grep -E ‘113039’\|’113019′ 2020-06-19T16:22:23,SENSOR01.asa5505.myorg.local,%ASA-6-113039: Group User IP <78.78.78.78> AnyConnect parent session started.2020-06-19T17:57:55,SENSOR01.asa5505.myorg.local,”%ASA-4-113019: Group = SSLVPN, …
Continue reading →Office 365 hardening tips & tricks
Links open directly to the relevant pages in Office 365 Enable MFA for Administrative Accounts. 2. Configure PIM (Privileged Identity Management) for Admin Accounts.Microsoft Documentation – O365 License …
Continue reading →