Timbo Smash

Read it, Smash it!

security

  • Smashed and Passed – AWS Certified Security – Specialty (SCS-C02) Exam

    Just re-did my AWS Security Specialty Exam. I really like the updates this exam has from when I took it last time. It could go deeper on topics like KMS, Security Hub, and IAM. Overall, it is an excellent test of a significant subject in the security of the AWS Cloud. #aws #awssecurity #cloud #security… Read more

  • Smash some new AWS Certs for AI and ML

    Now that I’ve passed these exams, I wanted to share some thoughts from a security perspective, along with some general observations:AI1-C01: AWS Certified AI Practitioner (Beta) – PassedI was pleasantly surprised to see that security topics make up about 15% of the exam.– Covers general AWS security (IAM, CloudWatch, CloudTrail)– Focuses on Bedrock security– Guardrails… Read more

  • How can I use model explainability in AI with chatgpt to understand its desicions

    To understand the decisions made by ChatGPT and leverage model explainability in AI, there are several approaches you can use, especially when it comes to explainable AI (XAI) techniques. Here’s how you can apply model explainability in AI to ChatGPT-like models: 1. Token-Level Interpretability: Attention Mechanisms: GPT-based models like ChatGPT use attention mechanisms to focus… Read more

  • Smashing the new Claude 3.5 to create security playbook for past events — ExternalBlue

    EternalBlue SOC Playbook Use network intrusion detection systems (NIDS) like Snort or Suricata to monitor for EternalBlue exploitation attempts. Configure alerts for unusual SMB traffic on port 445, especially from external IP addresses. Employ Security Information and Event Management (SIEM) tools like Splunk or ELK Stack to correlate logs and identify potential threats. Utilize endpoint… Read more

  • Smashing some custome wazuh to detect data dumps from git

    Not going to get into super detail but webhook to get the push and pulls into Wazuh. 1 Configure wazuh to accept the logs inputs for github in ossec.conf 2. Create a decoader in using regex /var/ossec/etc/decoders/local_decoder.xml <regex>.*”pull_request”:.*</regex> <regex>.*”pusher”:.*</regex> 3. Create rules to file and record: /var/ossec/etc/rules/local_rules.xml <rule id=”100100″ level=”3″> <decoded_as>github-push</decoded_as> <rule id=”100101″ level=”3″> <decoded_as>github-pull</decoded_as>… Read more

  • I smashed Wazuh back in the day

    I really liked wazuh, but with AI Wazuh is going ot have to step up the game. Great for small shops but next level for wazuh has to be AI and building models now. They are data rich and I could have some fun smashing some AI ideas with it. Read more