Parsing indicators and payloads
After selecting our scope of threat and research sources to use as accelerators, we can begin automating certain areas, bolstering detections and prevention. Even when the sources are machine-readable, the content still has to be parsed and implemented where appropriate. IOCs are typically the easiest due to the straightforward use of regular expressions (regex). Using regex, we can extract IOCs and implement them into security solutions such as EDRs and firewalls.
Hands-on lab work
The remainder of this chapter’s content is all lab work. It is recommended to follow along and type and execute commands and code to get the most out of this coursework. You may also download a copy of the full working code. Please refer to the Technical requirements section of this chapter to prepare your environment for lab work if you have not already done so. We also recommend you take a snapshot baseline of your VM before each lab so you can restore it to...
