Achievement unlocked: Presenting at BSides Munich! ✅✨ On Nov 17th I presented my talk ”From Hours to Minutes: Automating Incident Response Triage with Open-Source Tools”. Thanks to the @bsidesmunich.bsky.social organizers, volunteers and attendees for an amazing conference!

Great stuff from Maarten and the Timesketch team!

🚀 Just launched: DetectionForge — a purpose-built platform for crafting, testing & validating @limacharlie.io detection rules. Perform detection unit tests & multi-org backtesting + import/export IaC 🔗 Try it: detectionforge.ddi.sh 💻 GitHub: github.com/Digital-Defe... #detectionengineering #secops

Great summary of a great paper. Worth a read if you are building LLM agents systems.

Great stuff from Eric and Whitney.

Here are the slides/resources from our #SecurityFest talk on "Modernizing Incident Response Using Techniques that Scale" Talk: www.youtube.com/live/Znl7TBF...

Some excellent work by @craiggidney.bsky.social that reduces the number of qubits (in a quantum computer) required to break RSA by 20-fold. If you don’t have a migration plan to safe algorithms, now is the time to start one!

tested #openrelik, #hayabusa, #timesketch and #splunk4dfir using #thedfirreport recent analyst case. was a lot fun! will definitely use those tools more now 🚀

Hey #DFIR people! New #OpenRelik release just dropped. Some cool new features and a bunch of bug fixes.

A new Unfurl release is here! v2025.02 adds: 🌐 Parsing encoded/obfuscated IP addresses 🦋 Resolving #Bluesky handles to their identifiers (DIDs) and looking up their creation timestamps 🐛 Bug fixes & better bulk parsing Blog: dfir.blog/unfurl-parse... Code: github.com/obsidianfore... #DFIR #OSINT

Hayabusa - A sigma-based threat hunting and fast forensics 🔎 timeline generator for Windows event logs. It can easily be integrated with other hunting & DFIR tools such as Velociraptor & OpenRelik. Check it out 🔥🔥: github.com/Yamato-Secur... #threathunting #DFIR #sigma #cybersecurity #infosec

This is absolute insanity.

Much welcomed updates to GitHub Issues. simonwillison.net/2025/Jan/16/...

It's easy to lose sight of the fact that, from a tech perspective, we're absolutely living in the future. Our CEO and co-founder @apenwarr.ca looks at just how powerful our modern machines are — and what that means for all of us

Wooden satellite.. amazing. And built without nails or glue. Oh Japan, never change ♥️ www.theregister.com/2025/01/08/j...

Great stuff from @tomchop.me! Memory analysis and Yara support in #OpenRelik #DFIR

Great summary of last year of databases.

Here's my end-of-year review of things we learned out about LLMs in 2024 - we learned a LOT of things simonwillison.net/2024/Dec/31/... Table of contents:

In Sweden you have to take every opportunity to surf, regardless of the weather and season.. this one is for @halvarflake.bsky.social (In Swedish, but the picture really tells the whole story :) www.svt.se/nyheter/loka...

Home Assistant is an amazing OSS project. I'll excited to build on the new Voice device. I will get mine in a few days, and I can finally talk to my house! Build any automation I can imagen. Custom wake word (ok computer 🖖). LLM function calling anyone... www.youtube.com/live/ZgoaoTp...

New #OpenRelik release. Task metrics (queue length, completion, failures etc) & new Prometheus exporter. Plus, a new task dashboard for deep dives into task performance. 📝 openrelik.org/changelog/ 🔗 discord.gg/hg652gktwX #DFIR

Within software architecture, few people shaped the industry as much as @gradybooch.bsky.social. Safe to say he's a true legend. In today's The Pragmatic Engineer Podcast episode, he shares fascinating stories, insights, observations. Watch here: newsletter.pragmaticengineer.com/p/software-a...

When I moved back to Sweden a few years back my team snagged my password in this great tradition. The hack involved ketchup and I was very proud of everyone involved. bughunters.google.com/blog/6355265...

🚀 New OpenRelik release Role-based access control, folder sharing, database improvements, optimisations for file listings, chunked file uploads, bug fixes and refactoring efforts to improve stability. 📝 https://openrelik.org/changelog/ 🔗 https://discord.gg/hg652gktwX #DFIR

That little countdown on 2FA apps stresses the shit out of me. I feel like I'm diffusing a bomb. If it gets into the red, I just wait. I can't handle the stress.

Interesting read, well done @volexity.com

Let's Encrypt is now used by more than 500,000,000 websites!!! I could not be more happy and proud of everyone who has played a part in this colossal contribution to online safety, integrity, and confidentiality:

Since I'm trying out #Bluesky, I figured I should add in support for it in Unfurl! The v2024.11.20 release has some minor updates, but the biggest feature is the ability to parse a timestamp from Bluesky post IDs (or atproto TIDs). Example: dfir.blog/unfurl/?url=... Give it a try at unfurl.link!

It's happening. #DFIR comminity is back in business.

I attended a meetup in Seattle and got to spend time with @bnewbold.net and @pfrazee.com from the Bluesky engineering team. I walked away with an understanding of the role DIDs and PDSs play in the grand scheme of things, and why the most exciting work sits higher up the stack. I almost unretired.

Great resource for training and testing in #DFIR. Thanks for sharing with the community @binaryz0ne.bsky.social

Bluesky now has over 20M people!! 🎉 We've been adding over a million users per day for the last few days. To celebrate, here are 20 fun facts about Bluesky:

This is kinda big.

TIL: deck.blue - Like Tweet Deck but for Bluesky. Looks promising.

I really like the "Quiet posters" feed. Full of great content from your network from those who don't post that often, but when they do, it is thoughtful. Highly recommend! bsky.app/profile/did:...

⚡️ Introducing the OpenRelik Community Discord Server! A dedicated space for technical conversation around the OpenRelik platform. 🔗 Join now to connect, share your ideas and learn from other #DFIR practitioners! https://discord.gg/rTxr2HXUKU

Access your #OpenRelik server from your @tailscale.com tailnet with this new guide. Tailscale is awesome for simplifying secure network access, and this guide makes it easy to integrate with your existing OpenRelik Docker containers.

I'm on my way to #FIRSTCON24 in Fokuoka Japan. Looking forward to catching up with old and new friends in the incident response community! Let me know if you want to chat about open source #DFIR tooling (or anything else in the #infosec bubble), I'm around all week.

‼️🚨NEW report and blog from the @Google TAG and @Mandiant teams explores the implications of the Israel-Hamas war and where things stand with cyber in the Russian war in Ukraine: blog.google/technology/s...

✨ New Timesketch release! A notable feature we added this time is connectors to different LLM services. Out of the box we have support for Ollama (for open models) and VertexAI from Google. We continue building the foundation for Assisted Investigations. timesketch.org/changelog/#v...

New Timesketch release is out. Two highlights: - Unfurl [1] integration, get information from URLs directly in your timeline. - DFIQ [2] support with context aware SearchHistory. Changelog: timesketch.org/changelog/#v... [1] dfiq.org [2] dfir.blog/introducing-...

Hey folks, there is a new Timesketch release available. * OpenSearch 2.x support * Export query results to CSV * Extending Plaso formatters (e.g. show evtx message strings as default) * Include / exclude filters * Tag filter chips for Sigma timesketch.org/changelog/

Hey DFIR folks: we released a new version of Timesketch today. - OpenSearch queries in DFIQ - Preserve user defined filters - Support event list sorting - Rework comments - Analyzer results in the CLI - Sketch attributes in the CLI https://github.com/google/timesketch/releases/tag/20230721

Never take file paths for granted in digital forensics. New blog post by Joachim Metz: https://osdfir.blogspot.com/2023/07/whats-in-file-path.html