Med-Mastodon

Sasha the Dancing Flamingo🦩💻✨ Homelabs Just Got Sassier ✨💻🦩Hi hi, it’s me—Sasha the Flamingo, resident homelab hacker and surveillance sorceress.You know how most people build a humble little lab with a router and maybe a VM or two?Well. I may have gone full flamboyance with it.I just added not one, but TWO AI-powered nodes to my homelab talk, and let me tell you—they’re fabulous:🎥 SashaCam 5000 – A Raspberry Pi 5 with night vision, a Hailo-8 AI hat, and a USB camera that detects intruders and cats in real time. It logs, it snapshots, it even side-eyes suspicious activity at 2am.🧠 FlamingoSec IDS+LLM Rig – Another Pi 5 with NVMe SSDs and a Coral USB accelerator running Suricata, forwarding logs to Wazuh, and summarizing alerts with a local LLM. It’s like having a tiny SOC that never sleeps… but in hot pink.No cloud. No license fees. Just open source, smart birds, and slightly overcaffeinated engineering.Adding both of these to my homelab presentation to show that you don’t need a rack of servers to build something powerful, weird, and downright useful.Stay tuned. Things are about to get very… feathered.— Sasha 🦩🔐💾<a href="https://infosec.exchange/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#homelab</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/ai" class="mention hashtag" rel="nofollow noopener" target="_blank">#ai</a> <a href="https://infosec.exchange/tags/raspberrypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#raspberrypi</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#wazuh</a> <a href="https://infosec.exchange/tags/suricata" class="mention hashtag" rel="nofollow noopener" target="_blank">#suricata</a> <a href="https://infosec.exchange/@rnbwkat" class="u-url mention" rel="nofollow noopener" target="_blank">@rnbwkat</a>

securityaffairs<a href="https://infosec.exchange/tags/Mirai" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mirai</a> botnets exploit <a href="https://infosec.exchange/tags/Wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wazuh</a> RCE, Akamai warned <a href="https://securityaffairs.com/178830/malware/mirai-botnets-exploit-wazuh-rce-akamai-warned.html" rel="nofollow noopener" translate="no" target="_blank">https://securityaffairs.com/178830/malware/mirai-botnets-exploit-wazuh-rce-akamai-warned.html</a> <a href="https://infosec.exchange/tags/securityaffairs" class="mention hashtag" rel="nofollow noopener" target="_blank">#securityaffairs</a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#hacking</a>

Dave Thacker<a href="https://techtoots.com/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#homelab</a> installation of <a href="https://techtoots.com/tags/wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#wazuh</a> fails. It's time for bed. I know the root cause and I'll make better mistakes tomorrow. Good Night. <a href="https://techtoots.com/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#linux</a>

The Chris DantesToday's <a href="https://social.linux.pizza/tags/selfhosted" class="mention hashtag" rel="nofollow noopener" target="_blank">#selfhosted</a> project is to configure <a href="https://social.linux.pizza/tags/Wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wazuh</a> to stop ransomware attacks. I don't use Windows much, so I'll probably never know of it works, and of it doesn't, I don't save things locally. But it's a nice day out, so I should stay inside.

The Chris DantesI think the best part about having a <a href="https://social.linux.pizza/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#homelab</a> is that it reminds me that I'm stupid and don't know enough. I got <a href="https://social.linux.pizza/tags/wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#wazuh</a> installed and some agents setup. Now I need to learn what to do with this information.

PhilI have a very strange issue with my VPS. I am setting up wazuh for my personal use, and while the software seems to run just great, I'm unable to connect agents to it. 1. Wazuh does bind the ports (1514, 1515) properly. At least, netstat tells me to. 2. I can tcpdump on these ports, and see activity on 1515 (agent registration port). 3. The SYN packets never get a response from my VPS. It's like Wazuh is binding the ports, but isn't getting the packets or responding to them. I'm completely out of ideas. The Wazuh community Discord has been unhelpful, so far. I suspect ghosts. Any help? <a href="https://fed.bajsicki.com/tags/wazuh" rel="nofollow noopener" target="_blank">#wazuh</a> <a href="https://fed.bajsicki.com/tags/sysadmin" rel="nofollow noopener" target="_blank">#sysadmin</a> <a href="https://fed.bajsicki.com/tags/linux" rel="nofollow noopener" target="_blank">#linux</a> <a href="https://fed.bajsicki.com/tags/selfhosted" rel="nofollow noopener" target="_blank">#selfhosted</a>

Marcel SIneM(S)US<a href="https://social.tchncs.de/tags/Opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#Opensource</a>-Sicherheitsplattform: Kritische Lücke in <a href="https://social.tchncs.de/tags/Wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wazuh</a> erlaubte Codeschmuggel | Security <a href="https://www.heise.de/news/Opensource-Sicherheitsplattform-Kritische-Luecke-in-Wazuh-erlaubte-Codeschmuggel-10279201.html" rel="nofollow noopener" translate="no" target="_blank">https://www.heise.de/news/Opensource-Sicherheitsplattform-Kritische-Luecke-in-Wazuh-erlaubte-Codeschmuggel-10279201.html</a> <a href="https://social.tchncs.de/tags/Patchday" class="mention hashtag" rel="nofollow noopener" target="_blank">#Patchday</a>

Marcel SIneM(S)US<a href="https://social.tchncs.de/tags/Wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wazuh</a>: Unternehmenssicherheit mit <a href="https://social.tchncs.de/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenSource</a> | iX | heise magazineAngesichts ständiger Cyberangriffe ist der Schutz der IT-Infrastruktur für jedes Unternehmen ein Muss. Die lizenzkostenfreie Securityplattform Wazuh vereint umfangreiche Monitoring- und Abwehrfunktionen. <a href="https://www.heise.de/select/ix/2024/12/2429208320742870390" rel="nofollow noopener" translate="no" target="_blank">https://www.heise.de/select/ix/2024/12/2429208320742870390</a>

nemo™ 🇺🇦Frank Neugebauer erklärt die Vorteile der Open-Source-Securityplattform Wazuh. 🛡️💻 Sie bietet umfassende Funktionen wie Log-Analyse und Intrusion Detection, ideal für Unternehmen mit begrenztem Budget! 💰✨ Wazuh ist eine kosteneffiziente Lösung, die technisches Know-how erfordert. Wer bereit ist, Zeit und Aufwand zu investieren, findet hier eine starke Alternative zu kommerziellen Anbietern. <a href="https://mas.to/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://mas.to/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenSource</a> <a href="https://mas.to/tags/Wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wazuh</a> <a href="https://mas.to/tags/newz" class="mention hashtag" rel="nofollow noopener" target="_blank">#newz</a> <a href="https://www.heise.de/news/Drei-Fragen-drei-Antworten-Die-Open-Source-Securityplattform-Wazuh-10195078.html" rel="nofollow noopener" translate="no" target="_blank">https://www.heise.de/news/Drei-Fragen-drei-Antworten-Die-Open-Source-Securityplattform-Wazuh-10195078.html</a>

deftpunk ❌<a href="https://fosstodon.org/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> Anyone have practical experience with <a href="https://fosstodon.org/tags/wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#wazuh</a> xdr/siem? If so, I'd be interested re: your thoughts/exerience.

undeadAnd, maybe I could be wrong about this? Maybe I'm not seeing a hidden colon somewhere that they say MUST cause this issue? :flan_shrug:But I'm probably not. What I am doing is documenting all of my expectations and findings in my mailing list exchange with <a href="https://hackers.town/tags/wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#wazuh</a> so another user doesn't have to go through this again. As much as it sucks to nitpick about details and probably frustrate the other person, nobody should have to spell this out again, whether or not I'm wrong. If I'm assuming this, then others will as well.

undead<a href="https://hackers.town/tags/Wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wazuh</a> agent configurator could use some work.

PollitoWazuh and MITRE Caldera Using FreeBSD Jails <a href="https://freebsdfoundation.org/our-work/journal/browser-based-edition/wazuh-and-mitre-caldera-using-freebsd-jails/" rel="nofollow noopener" target="_blank">https://freebsdfoundation.org/our-work/journal/browser-based-edition/wazuh-and-mitre-caldera-using-freebsd-jails/</a> <a href="https://mastodon.sdf.org/tags/wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#wazuh</a> <a href="https://mastodon.sdf.org/tags/mitre" class="mention hashtag" rel="nofollow noopener" target="_blank">#mitre</a> <a href="https://mastodon.sdf.org/tags/mitrecaldera" class="mention hashtag" rel="nofollow noopener" target="_blank">#mitrecaldera</a> <a href="https://mastodon.sdf.org/tags/freebsd" class="mention hashtag" rel="nofollow noopener" target="_blank">#freebsd</a> <a href="https://mastodon.sdf.org/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://mastodon.sdf.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://mastodon.sdf.org/tags/appjail" class="mention hashtag" rel="nofollow noopener" target="_blank">#appjail</a> <a href="https://mastodon.sdf.org/tags/jail" class="mention hashtag" rel="nofollow noopener" target="_blank">#jail</a> <a href="https://mastodon.sdf.org/tags/jails" class="mention hashtag" rel="nofollow noopener" target="_blank">#jails</a>

Vitex<a href="https://witter.cz/@kayla_eilhart" class="u-url mention" rel="nofollow noopener" target="_blank">@kayla_eilhart</a> <a href="https://mastodon.rfc1925.org/@ondrej" class="u-url mention" rel="nofollow noopener" target="_blank">@ondrej</a> Nedavno jsem sebral odvahu a nasadil na svoji infrastrukturu <a href="https://f.cz/tags/wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#wazuh</a> a jsem zděšen! Kdybych každý den opravil jednu věc co se tomu nelíbí, tak nebudu nikdy hotov. <a href="https://f.cz/tags/ITSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#ITSecurity</a>

ChiefGyk3DI may be getting <a href="https://social.chiefgyk3d.com/tags/Crowdstrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#Crowdstrike</a> for my homelab in a few months. I want to see about tying it into <a href="https://social.chiefgyk3d.com/tags/Wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wazuh</a> eventually and covering all my desktops and servers.

ChiefGyk3DI’m about $300 away from my goal of purchasing a new <a href="https://social.chiefgyk3d.com/tags/pfsense" class="mention hashtag" rel="nofollow noopener" target="_blank">#pfsense</a> firewall. Once I transfer everything to the new firewall I will try and do a <a href="https://social.chiefgyk3d.com/tags/twitch" class="mention hashtag" rel="nofollow noopener" target="_blank">#twitch</a> stream setting up a firewall from scratch using my cell backup internet. Then once I run through that for y’all I will wipe it clean and make the current box a <a href="https://grafana.social/@grafana" class="u-url mention" rel="nofollow noopener" target="_blank">@grafana</a> and <a href="https://social.chiefgyk3d.com/tags/SIEM" class="mention hashtag" rel="nofollow noopener" target="_blank">#SIEM</a> box using <a href="https://social.chiefgyk3d.com/tags/Wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wazuh</a> probably. So if you want to help out please tip me in my links or subscribe on <a href="https://social.chiefgyk3d.com/tags/tiktok" class="mention hashtag" rel="nofollow noopener" target="_blank">#tiktok</a> or twitch <a href="https://social.chiefgyk3d.com/tags/streamer" class="mention hashtag" rel="nofollow noopener" target="_blank">#streamer</a> <a href="https://social.chiefgyk3d.com/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#linux</a> <a href="https://social.chiefgyk3d.com/tags/opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#opensource</a> <a href="https://social.chiefgyk3d.com/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://social.chiefgyk3d.com/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a>

K. LathamNetworkChuck did a great little tutorial about <a href="https://mastodon.social/tags/Wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wazuh</a>: <a href="https://youtu.be/3CaG2GI1kn0" rel="nofollow noopener" translate="no" target="_blank">https://youtu.be/3CaG2GI1kn0</a>

K. LathamLooking at <a href="https://mastodon.social/tags/Wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wazuh</a> this morning. <a href="https://wazuh.com/" rel="nofollow noopener" translate="no" target="_blank">https://wazuh.com/</a>See if I can convince the powers-that-be here at the office to try it out. I think they want to be hands-off though. Use a third-party like Connectwise for <a href="https://mastodon.social/tags/SIEM" class="mention hashtag" rel="nofollow noopener" target="_blank">#SIEM</a>.

kravietz 🦇<a class="u-url mention" href="https://dadalo.pl/@dadalo_admin" rel="nofollow noopener" target="_blank">@dadalo_admin</a> Large part of my work is in the infrastructure security sector and I think I can help at least with some of these challenges you described:<ul><li>there are databases of IP addresses and subnets that are known to run dumb, persistent scanners, bruteforcers etc - these should be blocked right away at the firewall level and that’s the first line of defense; the lists are usually updated every hour or daily</li><li>more sophisticated spam/hacking teams cycle their IP addresses, use Tor or set up dedicated infrastructure for your campaign only, but then so are the intrusion detection tools - <a class="hashtag" href="https://agora.echelon.pl/tag/wazuh" rel="nofollow noopener" target="_blank">#Wazuh</a> and <a class="hashtag" href="https://agora.echelon.pl/tag/crowdsec" rel="nofollow noopener" target="_blank">#Crowdsec</a> are two solutions I have been using a lot that will allow you to block an IP address instantly when a suspicious pattern is detected in your logs, which basically allows you to block them on the spot</li></ul>These tools deal with HTTP server logs or application logs, so you can usually do whatever kind of matching you can come up with and write custom signatures such as “a 10 characters long alphanumeric usernames created from the same IP over 15 minutes”. They are not silver bullets as any such tool can be bypassed by a sufficiently resourced and sophisticated team, but they significantly increase the cost of the campaign for the attacker.I don’t have any Mastodon instances but have implemented them for Pleroma, NextCloud and many other solutions, so happy to help with deployment for your Mastodon instance if interested.<a class="u-url mention" href="https://infosec.exchange/@briankrebs" rel="nofollow noopener" target="_blank">@briankrebs</a> <a class="u-url mention" href="https://oisaur.com/@renchap" rel="nofollow noopener" target="_blank">@renchap</a> <a class="u-url mention" href="https://mastodon.bentasker.co.uk/@ben" rel="nofollow noopener" target="_blank">@ben</a>

Jesse HarrisBeen busy setting up a <a href="https://infosec.exchange/tags/Wazuh" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wazuh</a> server in my <a href="https://infosec.exchange/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#homelab</a>. It's a class assignment, but I've been meaning to do it anyway and am glad to have the push to get it done.

Recent searches

Search options

Administered by:

Server stats:

#wazuh