2 ms·
Not necessarily from Crowdstrike CSIRT, but I have experience of security calling me back within 30 minutes of changing system security impacting file to verify
by p_l 2y ago
Not necessarily from Crowdstrike CSIRT, but I have experience of security calling me back within 30 minutes of changing system security impacting file to verify that it was done by me and not something else.
Probably because they had already looked at the modification which was benign so slower escalation path in absence of other indicators.
- rswail 2y agotripwire(1) has been part of systems for decades. Bullshit about "they had already looked at the modification which was benign". So your "security" is to totally expose every operation of your software to an external party with absolutely no auditing of what data they are exfiltrating from your system?
- p_l 2y agoIt was handled by internal security team. Also, tripwire was limited to periodically scanning files, couldn't scan for example syscalls and trace relationships between them. But yes, tripwire is a very early EDR/XDR.