Posts

Life of a GRR message

Image
Life of a GRR message Authored by Dan Aschwanden and Mikhail Bushkov, copied with permission. Introduction In this article a macro-level outline of how GRR Rapid Response (or GRR) messages are delivered via Fleetspeak as the communication conduit is provided. The details covered in this article will be valuable for scenarios where you need to debug or troubleshoot functionalities of GRR and/or Fleetspeak. Furthermore, the content in this article is also suitable as a first introduction to GRR and Fleetspeak. So whether you only get started or you are a seasoned practitioner we hope you will be able to take away something useful from this article. Fleetspeak does much of the heavy lifting for the GRR message exchange. Its design has some unique networking requirements which we already covered in a previous article . In this article we dive into the nature of the persistent connections that Fleetspeak clients (aka agents like GRR) use to communicate with the Fleetspeak server (aka fron

How do you know you are "Ready to Respond"?

Image
How do you know you are "Ready to Respond"? The Continuous Improvement Framework - A framework designed to help improve a team’s response readiness through data driven actions  Authors: Angelika Rohrer , Jon Brown Contributors: Joachim Metz January 2024 ___ About this paper What is the CI Framework? Introduction What does “Ready to Respond” mean? Measuring Response Readiness Continuous Improvement (CI) Framework Benefits How do you implement the CI Framework? So, where do you start? 1. Response Strategy 2. Critical Phases 3. Measurements and Metric Selection (KPIs) 4. Procedural Health Assessment 5. Gap Analysis Report & Planning input Conclusion Appendix Appendix A: CI Framework - Response Strategy Categorisation Template Appendix B: CI Framework - Sample Evaluation Phishing Appendix C: CI Framework - Sample Response Category Catalog Appendix D: CI Framework - Sample Gap Analysis Report ___ About this paper In this paper we are introducing the idea of a “Continuous Im