atlasdb VS windows-event-forwarding

Disclaimer that I left in 2014, but at that time they didn’t lean into their reputation at all. With that said, I’d guess that they’re leaning into it and capitalizing on it because any press is good press.

They were actually incredibly open with what they actually did technically, and a lot of who they worked with it’s just that nobody seemed to care at the time. They had tech talks showing the full system architecture on YouTube that didn’t get more than 10k or so views. A quick search indicates that a lot of those are gone now (maybe just outdated) and the channel is more marketing heavy now, but just as low trafficed.

They also open source a lot of their core technologies. The main database they used was “AtlasDB”, a relational layer on top of Cassandra. It’s open sourced and actively developed, and again, nobody seems to care, with it at a measly 700ish stars - https://github.com/palantir/atlasdb

People just like a good boogie man story, and after 2 decades of being labeled as such eventually you just stop trying to fight it I guess.

Hi All , We have deployed https://github.com/palantir/windows-event-forwarding/tree/master/AutorunsToWinEventLog which create autoruns entries into a custom event channel named Autoruns. We did filter to pic up this channel but no luck. the filter is like

Here is an up to date documentation with an example: https://github.com/palantir/windows-event-forwarding/tree/master/windows-event-channels

Palantir has an excellent guide on this approach, https://github.com/palantir/windows-event-forwarding, and ArcSight provides some shockingly good information as well https://community.softwaregrp.com/dcvta86296/attachments/dcvta86296/BestPractices/57/1/Micro_Focus_ArcSight_Collecting_Windows_Event_Logs.pdf.

You don't have a SIEM, but Windows has event forwarding built-in. There is a great overview here - https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection. With properly crafted subscriptions, with specific SMB events, you could better understand your environment by looking in just one log. This is another good resource - https://github.com/palantir/windows-event-forwarding.