Does anyone know of a list/can name companies that don't charge for SSO, Audit Logs[0], that have a free edition where you don't have to talk to a salesperson to evaluate etc.?
33 karma · joined July 26, 2016
Tines is completely different - we don't rely on any prebuilt integrations - similar to postman, if you have a curl command then you can paste it into Tines, and the response is simply the json from the API you're hitting - makes it a million times easier to do exactly what you want. You can then use that response in the next action. If the API is terrible (it frequently is) we've a ton of templates to help get the relevant data, and a community with experience connecting to most tools.
Would love to talk about the challenges and see if anything we're doing (or could do) which would have made it easier? I hope you're in a better job now anyway!
As mandatum says above “The UX of Tines beats the pants off ALL of their competitors.” And we can talk about price.
Happy to answer any questions folks have too!
https://github.com/holman/extended-exercise-windows is a good resource!
I know you say the team would be pissed, but it's actually the exact opposite! Firstly, most sophisticated companies have automated the abuse inbox management process, but even when it's not automated, I'd rather 100 easily ignorable reports about boner pills than one person not send an actual spear-phishing email. Plus we can use the generic spam reports to better train our spam filters so please do keep sending them, even the Nigerian prince stuff.
I'm not sure I get your analogy, but no, I wouldn't expel anyone for "radar touching my planes", but in this case that's the equivalent of browsing the DNC website. If someone had broken into my airforce base, stolen security badges to get into other airforce bases, was photographing planes and stealing and leaking blueprints then you better believe I'd take action
If you're looking for firewall logs or hard drives with definitive proof that malware on certain machines was linking back to particular servers then you're out of luck. However Crowdstrike, the firm that the DNC used to investigate the intrusion, published a report that shows some of the code used and other IOCs from the attack [0].
A security firm like Crowdstrike would have lots of familiarity with these APT groups from previous investigations, so when they identify these groups they have evidence (i.e. they found specific malware or tools that are known to have been used in previous attacks, connections to or from known bad domains, IP addresses etc.) that links the attacks to these groups.
This, however, doesn't prove that APT 28 and 29 are Russian, but if you search for information about these groups, their Tools Techniques and Procedures (TTPs), who they have targeted etc. you can draw your own conclusions.
Note, this was long before the election and before there was politics surrounding the attribution. However this data is only about the intrusion into the DNC's network, and not necessarily linked to the release of personal emails of Podesta & co.
[0] https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
Firstly we know that that Podesta's account was targeted by a phishing email with a bit.ly link [0]. We have proof the bit.ly phishing link in this email was clicked twice in March [1], and his wikileaks dump stops two days after that. The bitly link uses the TTP of base64 encoded strings targeting a google account. We know DNC staffers whose information was leaked by DC Leaks, like Rinehart, were targeted the same way [2] and that the same infrastructure hosted the Rinehart and Podesta phishing pages, along with plenty of other phishing sites [3]. You can verify the bitly links if you like.
We have reports long before Wikleaks released Podesta's information, and before DC leaks had released most of their information, that the same TTP of bitly links with base64 encoded strings that targeted Podesta, Rinehart etc. were targeting other high profile targets in Clinton's campaign [4] as well as Russians, Ukranians etc. [5]. According to security firms these were all using the same two bitly accounts.
Those attacks were attributed to APT 28 by private companies long before Wikileaks released any Podesta information.
We also have proof the same infrastructure that hosted dcleaks [6] hosted domains targeting Syrian human rights groups, Ukranians, Turks, Google accounts, Microsoft accounts etc. or that other IPs used were also used in attacks against the German Parliament, Tv5 etc. That's definitely circumstantial, but a one man job would be terribly unlucky to use a private Romanian server seen used in previous attacks attributed to a state actor.
Sure this could all be circumstantial, it definitely doesn't prove Russia did anything, but the suggestion that this is a one man operation is ludicrous - almost 4,000 people were targeted by the group that targeted the Clinton campaign. In relation to your other comment below, Assange has less credibility than the DHS report unless he comes out with some sort proof.
[0] https://wikileaks.org/podesta-emails/emailid/34899 [1] https://bitly.com/1PibSU0+ [2] http://www.thesmokinggun.com/documents/investigation/trackin... [3] https://www.passivetotal.org/search/80.255.12.237 [4] https://www.secureworks.com/research/threat-group-4127-targe... [5] https://www.secureworks.com/research/threat-group-4127-targe... [6] https://www.threatconnect.com/blog/does-a-bear-leak-in-the-w... and indeed this entire series.